CVE Vulnerabilities

CVE-2014-6153

Published: Dec 24, 2014 | Modified: Sep 08, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Affected Software

Name Vendor Start Version End Version
Websphere_service_registry_and_repository Ibm 7.5.0.4 7.5.0.4
Websphere_service_registry_and_repository Ibm 7.5.0.1 7.5.0.1
Websphere_service_registry_and_repository Ibm 7.0.0.1 7.0.0.1
Websphere_service_registry_and_repository Ibm 7.5.0.2 7.5.0.2
Websphere_service_registry_and_repository Ibm 8.0 8.0
Websphere_service_registry_and_repository Ibm 6.3.0.4 6.3.0.4
Websphere_service_registry_and_repository Ibm 6.3.0.1 6.3.0.1
Websphere_service_registry_and_repository Ibm 7.5.0.0 7.5.0.0
Websphere_service_registry_and_repository Ibm 7.0.0.4 7.0.0.4
Websphere_service_registry_and_repository Ibm 7.0.0.3 7.0.0.3
Websphere_service_registry_and_repository Ibm 7.0.0 7.0.0
Websphere_service_registry_and_repository Ibm 7.5.0.3 7.5.0.3
Websphere_service_registry_and_repository Ibm 6.3.0.2 6.3.0.2
Websphere_service_registry_and_repository Ibm 8.0.0.1 8.0.0.1
Websphere_service_registry_and_repository Ibm 8.5 8.5
Websphere_service_registry_and_repository Ibm 6.3.0.5 6.3.0.5
Websphere_service_registry_and_repository Ibm 6.3.0 6.3.0
Websphere_service_registry_and_repository Ibm 8.0.0.2 8.0.0.2
Websphere_service_registry_and_repository Ibm 6.3.0.3 6.3.0.3
Websphere_service_registry_and_repository Ibm 7.0.0.5 7.0.0.5
Websphere_service_registry_and_repository Ibm 7.0.0.2 7.0.0.2

References