CVE-2017-1142

MEDIUM

IBM Kenexa LCMS Premier on Cloud 9.x-10.0 - Info Disclosure

Title source: llm

Description

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM Reference #: 1998874.

References (2)

[Mitigation, Vendor Advisory] http://www.ibm.com/support/docview.wss?uid=swg21998874

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/97081

Scores

CVSS v3 6.5

EPSS 0.0018

EPSS Percentile 39.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-200

Status published

Affected Products (20)

ibm/kenexa_lcms_premier

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.0

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.1

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.2

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.2.1

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.3.0

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.4.0

... and 5 more

Timeline

Published Mar 27, 2017

Tracked Since Feb 18, 2026