CVE-2020-14248: Medium severity ibm bigfix platform vulnerability
BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this BigFix Inventory vulnerability?
The vulnerability ID of this BigFix Inventory vulnerability is CVE-2020-14248.
What is the title of this BigFix Inventory vulnerability?
The title of this BigFix Inventory vulnerability is 'BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session'.
What is the severity level of this BigFix Inventory vulnerability?
The severity level of this BigFix Inventory vulnerability is medium.
How does this BigFix Inventory vulnerability affect the software?
This BigFix Inventory vulnerability affects BigFix Inventory up to v10.0.2 by not setting the secure flag for the session cookie in an https session.
How can this BigFix Inventory vulnerability be exploited?
This BigFix Inventory vulnerability can be exploited by remote attackers capturing the session cookie which is sent in http requests.
Is there a fix available for this BigFix Inventory vulnerability?
Yes, a fix is available for this BigFix Inventory vulnerability. Please refer to the referenced link for more information.