NVD

Id
24070  
Name
CVE-2015-1848  
Description
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-05-14  
Modified Date
2016-12-30  
Seq
2015-1848  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
127764 24070 CVE-2015-1848 FEDORA-2015-8761  View
127765 24070 CVE-2015-1848 FEDORA-2015-8788  View
127766 24070 CVE-2015-1848 FEDORA-2015-8765  View
127767 24070 CVE-2015-1848 RHSA-2015:0980  View
127768 24070 CVE-2015-1848 RHSA-2015:0990  View
127769 24070 CVE-2015-1848 74623  View
127770 24070 CVE-2015-1848 https://bugzilla.redhat.com/attachment.cgi?id=1009855  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
7387 JVNDB-2015-002707 PCS の pcs デーモンにおける Cookie をキャプチャされる脆弱性 PCS の pcs デーモン (pcsd) は、https セッションの Cookie へ secure フラグを設定しないため、Cookie をキャプチャされる脆弱性が存在します。 CVE-2015-1848 79073 CVE-2015-1848 24070 6.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002707.html 2015-03-30 2015-05-19 View