Lucene search

[email protected]CVE-2014-6153

HistoryDec 24, 2014 - 11:59 a.m.

CVE-2014-6153

2014-12-2411:59:02

CWE-310

[email protected]

web.nvd.nist.gov

ibm

wsrr

websphere

service registry

repository

insecure cookie

vulnerability

cve-2014-6153

6.1 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

71.0%

JSON

The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Affected configurations

NVD

Node

ibmwebsphere_service_registry_and_repositoryMatch6.3.0

ibmwebsphere_service_registry_and_repositoryMatch6.3.0.1

ibmwebsphere_service_registry_and_repositoryMatch6.3.0.2

ibmwebsphere_service_registry_and_repositoryMatch6.3.0.3

ibmwebsphere_service_registry_and_repositoryMatch6.3.0.4

ibmwebsphere_service_registry_and_repositoryMatch6.3.0.5

ibmwebsphere_service_registry_and_repositoryMatch7.0.0

ibmwebsphere_service_registry_and_repositoryMatch7.0.0.1

ibmwebsphere_service_registry_and_repositoryMatch7.0.0.2

ibmwebsphere_service_registry_and_repositoryMatch7.0.0.3

ibmwebsphere_service_registry_and_repositoryMatch7.0.0.4

ibmwebsphere_service_registry_and_repositoryMatch7.0.0.5

ibmwebsphere_service_registry_and_repositoryMatch7.5.0.0

ibmwebsphere_service_registry_and_repositoryMatch7.5.0.1

ibmwebsphere_service_registry_and_repositoryMatch7.5.0.2

ibmwebsphere_service_registry_and_repositoryMatch7.5.0.3

ibmwebsphere_service_registry_and_repositoryMatch7.5.0.4

ibmwebsphere_service_registry_and_repositoryMatch8.0

ibmwebsphere_service_registry_and_repositoryMatch8.0.0.1

ibmwebsphere_service_registry_and_repositoryMatch8.0.0.2

ibmwebsphere_service_registry_and_repositoryMatch8.5

CPENameOperatorVersion
ibm:websphere_service_registry_and_repositoryibm websphere service registry and repositoryeq6.3.0
ibm:websphere_service_registry_and_repositoryibm websphere service registry and repositoryeq6.3.0.1
ibm:websphere_service_registry_and_repositoryibm websphere service registry and repositoryeq6.3.0.2
ibm:websphere_service_registry_and_repositoryibm websphere service registry and repositoryeq6.3.0.3
ibm:websphere_service_registry_and_repositoryibm websphere service registry and repositoryeq6.3.0.4
ibm:websphere_service_registry_and_repositoryibm websphere service registry and repositoryeq6.3.0.5
ibm:websphere_service_registry_and_repositoryibm websphere service registry and repositoryeq7.0.0
ibm:websphere_service_registry_and_repositoryibm websphere service registry and repositoryeq7.0.0.1
ibm:websphere_service_registry_and_repositoryibm websphere service registry and repositoryeq7.0.0.2
ibm:websphere_service_registry_and_repositoryibm websphere service registry and repositoryeq7.0.0.3

CPE	Name	Operator	Version
ibm:websphere_service_registry_and_repository	ibm websphere service registry and repository	eq	6.3.0
ibm:websphere_service_registry_and_repository	ibm websphere service registry and repository	eq	6.3.0.1
ibm:websphere_service_registry_and_repository	ibm websphere service registry and repository	eq	6.3.0.2
ibm:websphere_service_registry_and_repository	ibm websphere service registry and repository	eq	6.3.0.3
ibm:websphere_service_registry_and_repository	ibm websphere service registry and repository	eq	6.3.0.4
ibm:websphere_service_registry_and_repository	ibm websphere service registry and repository	eq	6.3.0.5
ibm:websphere_service_registry_and_repository	ibm websphere service registry and repository	eq	7.0.0
ibm:websphere_service_registry_and_repository	ibm websphere service registry and repository	eq	7.0.0.1
ibm:websphere_service_registry_and_repository	ibm websphere service registry and repository	eq	7.0.0.2
ibm:websphere_service_registry_and_repository	ibm websphere service registry and repository	eq	7.0.0.3