CVE-2019-4171

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies

Low · published September 17, 2019

CVSS v3.0
3.7
EPSS
1%
Percentile
50.1
In the wild
Unconfirmed
What it is

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 158876.

The record
Technical detail
CVSS v3.0
3.7 · LOW
Vector
CVSS:3.0/UI:N/A:N/AC:H/S:U/AV:N/C:L/I:N/PR:N/RC:C/E:U/RL:O
CVSS v4.0
Not supplied
EPSS
0.00642 · 50.1th percentile
Published
2019-09-17T19:05Z
EPSS history
Timeline
  • 17 SEP 19:05Z
    IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies
    cvelistv5