CVE-2015-1915
IBM Endpoint Manager for Remote Control 9.0.1-9.1.0 - Session Cookie Exposure via Missing Secure Flag
Title source: llmDescription
The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/74193
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21882571
Patch, Vendor Advisory vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV72069
Scores
EPSS
0.0121
EPSS Percentile
64.9%
Details
CWE
CWE-200
Status
published
Products (2)
ibm/endpoint_manager_family
9.0.1
ibm/endpoint_manager_family
9.1.0
Published
May 25, 2015
Tracked Since
Feb 18, 2026