Lucene search

[email protected]CVE-2015-4138

HistoryMay 30, 2015 - 7:59 p.m.

CVE-2015-4138

2015-05-3019:59:09

CWE-200

[email protected]

web.nvd.nist.gov

cve-2015-4138

blue coat ssl visibility appliance

webui

httponly

set-cookie

remote attack

sensitive information

script access

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.1 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.0%

JSON

The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not include the HTTPOnly flag in a Set-Cookie header for the administrator’s cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, a different vulnerability than CVE-2015-2855.

Affected configurations

NVD

Node

blue_coatssl_visibility_appliance_sv1800_firmwareRange≤3.8.3

AND

blue_coatssl_visibility_appliance_sv1800Match-

Node

blue_coatssl_visibility_appliance_sv800_firmwareRange≤3.8.3

AND

blue_coatssl_visibility_appliance_sv800Match-

Node

blue_coatssl_visibility_appliance_sv3800_firmwareRange≤3.8.3

AND

blue_coatssl_visibility_appliance_sv3800Match-

Node

blue_coatssl_visibility_appliance_sv2800_firmwareRange≤3.8.3

AND

blue_coatssl_visibility_appliance_sv2800Match-

CPENameOperatorVersion
blue_coat:ssl_visibility_appliance_sv1800_firmwareblue coat ssl visibility appliance sv1800 firmwarele3.8.3

CPE	Name	Operator	Version
blue_coat:ssl_visibility_appliance_sv1800_firmware	blue coat ssl visibility appliance sv1800 firmware	le	3.8.3

References

www.kb.cert.org/vuls/id/498348

bto.bluecoat.com/security-advisory/sa96

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.1 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.0%

JSON

Related for CVE-2015-4138

cvelist2 nvd2 cve1 prion2 cert1 symantec1