CVEvulnerability
CVE-2015-0102
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-02-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-287
Description
IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Affected configurations
• ibm workflow
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21694941 Broken Link
- http://www.securityfocus.com/bid/74220 Third Party Advisory, VDB Entry
- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-authentication-session-cookie-in-ibm-workflow-for-bluemix-was-missing-secure-flag-cve-2015-0102/ Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21694941 Broken Link
- http://www.securityfocus.com/bid/74220 Third Party Advisory, VDB Entry
- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-authentication-session-cookie-in-ibm-workflow-for-bluemix-was-missing-secure-flag-cve-2015-0102/ Vendor Advisory