CVE-2014-3092 Information disclosure in n/a

Medium 5.0 Published 12 Sep 2014 Updated 6 Aug 2024

Remote attackers can intercept session cookies due to missing secure flags, potentially leading to account takeover in IBM Rational products.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2014-3092?

CVE-2014-3092 is a medium-severity vulnerability in Ibm Rational Doors Next Generation, published on 12 Sep 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Weakness: CWE-200

Which versions are affected by CVE-2014-3092?

It affects 7 products.

Products include Ibm Rational Doors Next Generation, Ibm Rational Engineering Lifecycle Manager, Ibm Rational Quality Manager, Ibm Rational Requirements Composer, Ibm Rational Rhapsody Design Manager, Ibm Rational Software Architect Design Manager and 1 more.

How do I fix CVE-2014-3092?

No fix has been published for CVE-2014-3092 yet. Limit exposure of the affected software until one is available.

Is CVE-2014-3092 being exploited?

There is no known exploitation of CVE-2014-3092 in the wild and no public exploit code.

All Ibm Rational Doors Next Generation vulnerabilities

Sources

Also known as GHSA-3f45-qgc4-vqqg.