CVE-2017-1229

MEDIUM

IBM BigFix Platform 9.2-9.5 - Exposure of Sensitive Information via Missing HSTS

Title source: llm

Description

IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 123908.

References (2)

Core 2

Core References

Issue Tracking, Vendor Advisory x_refsource_confirm

http://www.ibm.com/support/docview.wss?uid=swg22005246

Issue Tracking, VDB Entry, Vendor Advisory x_refsource_misc

https://exchange.xforce.ibmcloud.com/vulnerabilities/123908

Scores

CVSS v3 5.9

EPSS 0.0122

EPSS Percentile 65.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (4)

IBM/BigFix family 9.2

IBM/BigFix family 9.5

ibm/bigfix_platform 9.2

ibm/bigfix_platform 9.5

Published Nov 13, 2017

Tracked Since Feb 18, 2026