medium4.0
CVE-2018-1480
IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies.
Impact
IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed attackers may be able to get the cookie values via malicious JavaScript and then hijack the user session. IBM X-Force ID: 140762.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ibm | Bigfix Platform | from 9.2.0 through 9.2.14 from 9.5 through 9.5.9 |