Information disclosure in IBM Rational Doors Next Generation
CVE-2014-3092
IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Vulnerability class: Information Disclosure
EPSS: 0.017 (74.4th percentile) — read the EPSS interpretation.
Affected products
- Ibm Rational_doors_next_generation — versions 4.0.0, 4.0.1, 4.0.2
- Ibm Rational_engineering_lifecycle_manager — versions 1.0, 1.0.0.1, 4.03
- Ibm Rational_quality_manager — versions 2.0, 2.0.0.1, 2.0.0.2
- Ibm Rational_requirements_composer — versions 2.0, 2.0.0.1, 2.0.0.2
- Ibm Rational_rhapsody_design_manager — versions 3.0, 3.0.0.1, 3.0.1
- Ibm Rational_software_architect_design_manager — versions 3.0, 3.0.0, 3.0.0.1
- Ibm Rational_team_concert — versions 2.0, 2.0.0.1, 2.0.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@us.ibm.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)