CVEvulnerability
CVE-2014-3103
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-09-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Affected configurations
• ibm rational clearcase 7.1
• ibm rational clearcase 7.1.0.1
• ibm rational clearcase 7.1.0.2
• ibm rational clearcase 7.1.1
• ibm rational clearcase 7.1.1.1
• ibm rational clearcase 7.1.1.2
• ibm rational clearcase 7.1.1.3
• ibm rational clearcase 7.1.1.4
• ibm rational clearcase 7.1.1.5
• ibm rational clearcase 7.1.1.6
• ibm rational clearcase 7.1.1.7
• ibm rational clearcase 7.1.1.8
• ibm rational clearcase 7.1.1.9
• ibm rational clearcase 7.1.2
• ibm rational clearcase 7.1.2.1
• ibm rational clearcase 7.1.2.2
• ibm rational clearcase 7.1.2.3
• ibm rational clearcase 7.1.2.4
• ibm rational clearcase 7.1.2.5
• ibm rational clearcase 7.1.2.6
• ibm rational clearcase 7.1.2.7
• ibm rational clearcase 7.1.2.9
• ibm rational clearcase 7.1.2.10
• ibm rational clearcase 7.1.2.11
• ibm rational clearcase 7.1.2.12
• ibm rational clearcase 7.1.2.13
• ibm rational clearcase 7.1.2.14
• ibm rational clearcase 8.0
• ibm rational clearcase 8.0.0.1
• ibm rational clearcase 8.0.0.2
• ibm rational clearcase 8.0.0.3
• ibm rational clearcase 8.0.0.4
• ibm rational clearcase 8.0.0.5
• ibm rational clearcase 8.0.0.6
• ibm rational clearcase 8.0.0.7
• ibm rational clearcase 8.0.0.8
• ibm rational clearcase 8.0.0.9
• ibm rational clearcase 8.0.0.10
• ibm rational clearcase 8.0.0.11
• ibm rational clearcase 8.0.1
• ibm rational clearcase 8.0.1.1
• ibm rational clearcase 8.0.1.2
• ibm rational clearcase 8.0.1.3
• ibm rational clearcase 8.0.1.4
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21682947 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94270 exchange.xforce.ibmcloud.com
- http://www-01.ibm.com/support/docview.wss?uid=swg21682947 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94270 exchange.xforce.ibmcloud.com