Vulnerability Description
Websense Web Security and Web Filter before 7.1 Hotfix 21 do not set the secure flag for the Encrypted Session (SSL) cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Websense | Websense Web Filter | <= 7.0 |
| Websense | Websense Web Security | <= 7.0 |
References
- http://www.websense.com/content/support/library/web/v711/ws711_known_issues/firsVendor Advisory
- http://www.websense.com/content/support/library/web/v711/ws711_known_issues/ws71Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78342
- http://www.websense.com/content/support/library/web/v711/ws711_known_issues/firsVendor Advisory
- http://www.websense.com/content/support/library/web/v711/ws711_known_issues/ws71Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78342
FAQ
What is CVE-2010-5148?
CVE-2010-5148 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Websense Web Security and Web Filter before 7.1 Hotfix 21 do not set the secure flag for the Encrypted Session (SSL) cookie in an https session, which makes it easier for remote attackers to capture t...
How severe is CVE-2010-5148?
CVE-2010-5148 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-5148?
Check the references section above for vendor advisories and patch information. Affected products include: Websense Websense Web Filter, Websense Websense Web Security.