CVE-2018-1481 - IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters

Back Back to CVE browser

MEDIUM

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters

Published Dec 12, 2018

5.3

MEDIUM

CVSS 3.0

EPSS 1.20%

Description

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 140763.

Affected products

Vendor IBM Product BigFix Platform Default
n/a
- Version
  9.2.0
  Status
  affected
  Constraints
  -
- Version
  9.2.14
  Status
  affected
  Constraints
  -
- Version
  9.5.0
  Status
  affected
  Constraints
  -
- Version
  9.5.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

BigFix Platform

n/a

Version	Status	Constraints
9.2.0	affected	-
9.2.14	affected	-
9.5.0	affected	-
9.5.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

https://exchange.xforce.ibmcloud.com/vulnerabilities/140763
vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10733605
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://exchange.xforce.ibmcloud.com/vulnerabilities/140763		vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10733605		x_refsource_CONFIRMVendor Advisory