CVE-2020-4146 - IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag

Back Back to CVE browser

MEDIUM

IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag

Published Nov 12, 2021

5.3

MEDIUM

CVSS 3.1

EPSS 1.11%

Description

IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 174129.

Affected products

Vendor IBM Product Security SiteProtector System Default
n/a
- Version
  3.1.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Security SiteProtector System

n/a

Version	Status	Constraints
3.1.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-732

Incorrect Permission Assignment

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25393
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/174129
vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6515056
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25393		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/174129		vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6515056		x_refsource_CONFIRMVendor Advisory