CVE-2020-14248

BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Score

CVSS 3.1 5.3 Medium

Status

Modified - psirt@hcl.com

Published

2020-12-16

Last modified

2024-08-04

Weaknesses

CWE-319

Affected products

• Bigfix Platform (Hcltech)

References

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085735