IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies.

Published 7 y ago 2018-12-12 · modified 4 mo ago 2026-06-17 · JSON

CVSS

3.7

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.0%

percentile 63%

Public exploits

none known

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 140969.

Exploit prediction (EPSS)

1.01% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	3.7	`CVSS:3.0/A:N/AC:H/AV:N/C:L/I:N/PR:N/S:U/UI:N/E:U/RC:C/RL:O`
CNA	3.0	3.7	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
NVD	3.0	3.7	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:P/I:N/A:N`

Affected products

IBM BigFix Platform

Classification

Weakness

CWE-384 Session Fixation

References

ibm.com /support/docview.wss?uid=ibm10733605 · x_refsource_CONFIRM, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/140969 · vdb-entry, x_refsource_XF, x_transferred

Sources

CVE List: CVE-2018-1484
NVD: CVE-2018-1484

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.