| Vulnerability Name: | CVE-2014-0909 (CCN-91872) | ||||||||
| Assigned: | 2014-09-04 | ||||||||
| Published: | 2014-09-04 | ||||||||
| Updated: | 2017-08-29 | ||||||||
| Summary: | The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-200 | ||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||
| References: | Source: MITRE Type: CNA CVE-2014-0909 Source: CCN Type: IBM Security Bulletin 1681449 Rational License Key Server Administration and Reporting Tool vulnerability (CVE-2014-0909, CVE-2014-3079 and CVE-2014-4756) Source: CONFIRM Type: Patch, Vendor Advisory http://www-01.ibm.com/support/docview.wss?uid=swg21681449 Source: CONFIRM Type: UNKNOWN http://www-01.ibm.com/support/docview.wss?uid=swg24038045 Source: BID Type: UNKNOWN 69642 Source: CCN Type: BID-69642 IBM RLKS Administration and Reporting Tool CVE-2014-0909 Information Disclosure Vulnerability Source: XF Type: UNKNOWN ibm-rcl-cve20140909-info-disc(91872) Source: XF Type: UNKNOWN ibm-rlksart-cve20140909-cookie(91872) | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| BACK | |||||||||