CVE-2014-6153: Medium severity ibm websphere service registry and repository vulnerability
The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-6153?
CVE-2014-6153 is classified as a medium-severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2014-6153?
To fix CVE-2014-6153, ensure that the secure flag is set for cookies in your IBM WebSphere Service Registry and Repository configuration.
Which versions are affected by CVE-2014-6153?
CVE-2014-6153 affects IBM WebSphere Service Registry and Repository versions 6.3.x to 6.3.0.5, 7.0.x to 7.0.0.5, 7.5.x to 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1.
What kind of attack can CVE-2014-6153 enable?
CVE-2014-6153 can enable remote attackers to capture session cookies, potentially compromising user sessions.
Is there a patch available for CVE-2014-6153?
Yes, IBM has released patches for affected versions of the WebSphere Service Registry and Repository to mitigate CVE-2014-6153.