Vulnerability Description
IBM DataPower Gateway appliances with firmware 6.x before 6.0.0.17, 6.0.1.x before 6.0.1.17, 7.x before 7.0.0.10, 7.1.0.x before 7.1.0.7, and 7.2.x before 7.2.0.1 do not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Datapower Gateway | <= 6.0.0.16 |
Related Weaknesses (CWE)
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT10279
- http://www-01.ibm.com/support/docview.wss?uid=swg21969342Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT10279
- http://www-01.ibm.com/support/docview.wss?uid=swg21969342Vendor Advisory
FAQ
What is CVE-2015-7427?
CVE-2015-7427 is a vulnerability with a CVSS score of 5.0 (MEDIUM). IBM DataPower Gateway appliances with firmware 6.x before 6.0.0.17, 6.0.1.x before 6.0.1.17, 7.x before 7.0.0.10, 7.1.0.x before 7.1.0.7, and 7.2.x before 7.2.0.1 do not set the secure flag for unspec...
How severe is CVE-2015-7427?
CVE-2015-7427 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-7427?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm Datapower Gateway.