CVE-2018-1480: Medium severity IBM BigFix Platform vulnerability
IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed attackers may be able to get the cookie values via malicious JavaScript and then hijack the user session. IBM X-Force ID: 140762.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1480?
CVE-2018-1480 is considered a medium severity vulnerability due to the potential for session hijacking through the lack of 'HttpOnly' attribute on cookies.
How do I fix CVE-2018-1480?
To fix CVE-2018-1480, ensure that the 'HttpOnly' attribute is set on authorization tokens and session cookies in the IBM BigFix Platform.
Which versions are affected by CVE-2018-1480?
CVE-2018-1480 affects IBM BigFix Platform versions 9.2.0 through 9.2.14 and versions 9.5 through 9.5.9.
What can an attacker do if CVE-2018-1480 is exploited?
If CVE-2018-1480 is exploited, an attacker can potentially hijack user sessions by accessing cookie values with malicious JavaScript.
Is there a workaround for CVE-2018-1480?
A workaround for CVE-2018-1480 is to review application code to ensure proper cookie settings are implemented until a patch is available.