NVD

Id
24117  
Name
CVE-2015-1915  
Description
The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2015-05-24  
Modified Date
2016-11-29  
Seq
2015-1915  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
127988 24117 CVE-2015-1915 IV72069  View
127989 24117 CVE-2015-1915 http://www-01.ibm.com/support/docview.wss?uid=swg21882571  View
127990 24117 CVE-2015-1915 74193  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
7473 JVNDB-2015-002793 IBM Tivoli Endpoint Manager for Lifecycle Management の Endpoint Manager for Remote Control コンポーネントにおけるセッション Cookie をキャプチャされる脆弱性 IBM Tivoli Endpoint Manager for Lifecycle Management の Endpoint Manager for Remote Control コンポーネントは、HTTPS セッションのセッション Cookie に secure フラグを設定しないため、セッション Cookie をキャプチャされる脆弱性が存在します。 CVE-2015-1915 79140 CVE-2015-1915 24117 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002793.html 2015-04-13 2015-05-27 View