CVE编号
CVE-2018-1948利用情况
暂无补丁情况
N/A披露时间
2019-02-22漏洞描述
IBM Security Identity Governance and Intelligence 5.2到5.2.4.1虚拟设备未在授权令牌或会话cookie上设置安全属性。攻击者可以通过向用户发送http：//链接或通过在用户访问的站点中植入此链接来获取cookie值。 cookie将被发送到不安全的链接，然后攻击者可以通过窥探流量来获取cookie值。 IBM X-Force ID：153428。<br>解决建议
厂商已发布了漏洞修复程序，请及时关注更新：https://www-01.ibm.com/support/docview.wss?uid=ibm10872142
参考链接 |
|
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/153428 | |
| https://www.ibm.com/support/docview.wss?uid=ibm10872142 |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | ibm | security_identity_governance_and_intelligence | * |
From (including) 5.2 |
Up to (including) 5.2.4.1 |
||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.6 | kvm | * |
Up to (excluding) 2.13.7-r2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.7 | kvm | * |
Up to (excluding) 2.15.r-r1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.8 | kvm | * |
Up to (excluding) 2.18.1-r1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | kvm | * |
Up to (excluding) 2.17.2-2.amzn2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | kvm | * |
Up to (excluding) 2.14.5-1.60.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_8 | kvm | * |
Up to (excluding) 1:2.1+dfsg-12+deb8u7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | kvm | * |
Up to (excluding) 1:2.8+dfsg-6+deb9u6 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_28 | kvm | * |
Up to (excluding) 2.17.2-2.fc28 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_29 | kvm | * |
Up to (excluding) 2.19.2-1.fc29 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.0 | kvm | * |
Up to (excluding) 2.16.4-lp150.2.9.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.3 | kvm | * |
Up to (excluding) 2.9.1-56.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | kvm | * |
Up to (excluding) 3.0.0-3.el7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_11_SP4 | kvm | * |
Up to (excluding) 1.4.2-60.21.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP3 | kvm | * |
Up to (excluding) 1.0.0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP4 | kvm | * |
Up to (excluding) 1.0.0 |
|||||
- 攻击路径 网络
- 攻击复杂度 低
- 权限要求 无
- 影响范围 未更改
- 用户交互 需要
- 可用性 无
- 保密性 低
- 完整性 无
还没有评论，来说两句吧...