DNA View

High Severity Vulnerability

This vulnerability has been rated as High severity. Immediate action is recommended.

CVE-2015-0102

High

Low Medium High Critical

8.1

CVSS Score

Published: Feb 05, 2020

Last Modified: Nov 21, 2024

CWE: CWE-287

Vulnerability Description

IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

1 configuration(s) from 1 vendor(s)

workflow

Version:

CPE:

cpe:2.3:a:ibm:workflow:-:*:*:*:*:bluemix:*:*

This vulnerability affects 1 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

8.1

out of 10.0

High

Weakness Type (CWE)

CWE-287 Top 25 #10

Improper Authentication

Description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Exploit Likelihood: High
Typical Severity: High
OWASP Top 10: A07:2021-Identification/Auth Failures
Abstraction Level: Class