« Volver al listado

CVE-2017-1142

Estado: ModificadaMedia (6.5)—

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM Reference #: 1998874.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Kenexa Lcms Premier

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-1142",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "IBM Corporation",
          "product": "Kenexa LCMS Premier on Cloud",
          "versions": [
            {
              "status": "affected",
              "version": "9.0"
            },
            {
              "status": "affected",
              "version": "9.1"
            },
            {
              "status": "affected",
              "version": "9.2"
            },
            {
              "status": "affected",
              "version": "9.2.1"
            },
            {
              "status": "affected",
              "version": "9.3.0"
            },
            {
              "status": "affected",
              "version": "9.4.0"
            },
            {
              "status": "affected",
              "version": "9.5.0"
            },
            {
              "status": "affected",
              "version": "10.0.0"
            },
            {
              "status": "affected",
              "version": "10.1.0"
            },
            {
              "status": "affected",
              "version": "10.2.0"
            },
            {
              "status": "affected",
              "version": "10.3.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-03-27T22:59:00.320",
  "references": [
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21998874",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/97081",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21998874",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/97081",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM Reference #: 1998874."
    },
    {
      "lang": "es",
      "value": "IBM Kenexa LCMS Premier en Cloud 9.x y 10.0 podrían permitir a un atacanter remoto obtener información sensible, provocado por el fallo para establecer el indicador seguro para la cookie de sesión en modo SSL. Interceptando esta transmisión dentro de una sesión HTTP, un atacante podría explotar esta vulnerabilidad para capturar la cookie y obtener información sensible. Referencia IBM #: 1998874."
    }
  ],
  "lastModified": "2026-06-17T01:13:57.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B5A416C-F511-4016-B04E-1C8030755234"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "424A977D-F0E8-4A5E-974A-62676F17599D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC1D6409-70BC-4ED0-A9A9-1A83EE61719D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA2557BE-4B29-4125-A39A-287F9F9FB6A8"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "764D4D62-19BA-4DE7-A2D8-233C45CA26B3"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3037BB6F-26C8-4F39-9FB5-1EF592E46B36"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E386AA38-B144-43F7-9790-8C79B5FC88E5"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA364F9B-AE53-402F-8FA9-EFDB45435964"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:10.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39991639-4A05-4AE8-B793-44A7B60F84F9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}