CVE-2017-1142: Infoleak
First published: Mon Mar 27 2017(Updated: )
IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM Reference #: 1998874.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Kenexa LCMS Premier | =9.1 | |
| IBM Kenexa LCMS Premier | =9.2 | |
| IBM Kenexa LCMS Premier | =9.2.1 | |
| IBM Kenexa LCMS Premier | =9.3 | |
| IBM Kenexa LCMS Premier | =9.4 | |
| IBM Kenexa LCMS Premier | =9.5 | |
| IBM Kenexa LCMS Premier | =10.0 | |
| IBM Kenexa LCMS Premier | =10.2 | |
| IBM Kenexa LCMS Premier | =10.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-1142?
The severity of CVE-2017-1142 is considered medium due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2017-1142?
To fix CVE-2017-1142, ensure that the secure flag is set for the session cookies in SSL mode.
Who is affected by CVE-2017-1142?
CVE-2017-1142 affects users of IBM Kenexa LCMS Premier versions 9.x and 10.0.
What type of vulnerability is CVE-2017-1142?
CVE-2017-1142 is a session management vulnerability that can lead to information disclosure.
Can CVE-2017-1142 be exploited remotely?
Yes, CVE-2017-1142 can be exploited remotely through intercepted HTTP sessions.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- agent/source
- vendor/ibm
- canonical/ibm kenexa lcms premier
- version/ibm kenexa lcms premier/9.1
- version/ibm kenexa lcms premier/9.2
- version/ibm kenexa lcms premier/9.2.1
- version/ibm kenexa lcms premier/9.3
- version/ibm kenexa lcms premier/9.4
- version/ibm kenexa lcms premier/9.5
- version/ibm kenexa lcms premier/10.0
- version/ibm kenexa lcms premier/10.2
- version/ibm kenexa lcms premier/10.3