Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-1228: IBM BigFix Platform could expose data to network eavesdroppers

CVE-2017-1228 · published 9 years ago

Summary

The IBM BigFix Platform (versions 9.2 and 9.5) does not mark its web cookies as secure, so a person who can intercept traffic between users and the server could read sensitive information. This risk is especially relevant when users access the system over unencrypted networks or public Wi‑Fi. Apply the vendor’s security update or configure the application to use secure cookies to protect the data.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	bigfix_platform	9.2 9.5 `cpe:2.3:a:ibm:bigfix_platform:9.2:::::::*`

Original advisory text

IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable the secure cookie attribute. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 123907.

References

http://www.ibm.com/support/docview.wss?uid=swg22009673 Patch Vendor Advisory
http://www.securityfocus.com/bid/101571 Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/123907 VDB Entry Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

3.7 Low

Exploitation

1% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published26 Oct 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-1228 · NVD

Track software like this

Free during beta