CVE-2014-0905: Low severity ibm infosphere biginsights vulnerability
IBM InfoSphere BigInsights 2.0 through 2.1.2 does not set the secure flag for the LTPA cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0905?
The severity of CVE-2014-0905 is considered medium due to the potential for remote attackers to intercept sensitive cookie data.
How do I fix CVE-2014-0905?
To fix CVE-2014-0905, configure the application to set the secure flag on the LTPA cookie to ensure it is only transmitted over HTTPS connections.
Which versions of IBM InfoSphere BigInsights are affected by CVE-2014-0905?
CVE-2014-0905 affects IBM InfoSphere BigInsights versions 2.0.0.0, 2.1.0.0, 2.1.1.0, and 2.1.2.0.
Can CVE-2014-0905 lead to data breaches?
Yes, CVE-2014-0905 can potentially lead to data breaches if attackers successfully intercept LTPA cookies.
Is there a workaround for CVE-2014-0905?
A potential workaround for CVE-2014-0905 is to utilize additional layers of encryption for cookie transmission in your application.