Vulnerability Details CVE-2014-4830
IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 48.6%
CVSS Severity
CVSS v2 Score 4.3
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21686478
- http://www.securityfocus.com/bid/71077
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95580
- http://www-01.ibm.com/support/docview.wss?uid=swg21686478
- http://www.securityfocus.com/bid/71077
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95580
Products affected by CVE-2014-4830
-
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.0
-
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0