Security Advisory

CVE-2018-1480

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2018-12-12 16:00:00

Last updated 2024-09-16 16:32:48

Assigner ibm

CVSS score 4.0

State PUBLISHED

Description

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed attackers may be able to get the cookie values via malicious JavaScript and then hijack the user session. IBM X-Force ID: 140762.

← Browse all CVEs View on cve.org ↗