CVE-2018-1485

Name of the Vulnerable Software and Affected Versions IBM BigFix Platform versions 9.2.0 through 9.2.14 IBM BigFix Platform versions 9.5 through 9.5.9

Description The issue is related to a session fixation/hijacking vulnerability. After a successful authentication, the session variable is not renewed, which could force a user to utilize a cookie that may be known to an attacker.

Recommendations For IBM BigFix Platform versions 9.2.0 through 9.2.14, update to a version that renews the session variable after successful authentication. For IBM BigFix Platform versions 9.5 through 9.5.9, update to a version that renews the session variable after successful authentication. As a temporary workaround, consider regenerating session variables after each successful authentication to minimize the risk of session fixation/hijacking.