CVE-2015-2855

{"id": "CVE-2015-2855", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-05-30T19:59:07.847", "references": [{"url": "http://www.kb.cert.org/vuls/id/498348", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cret@cert.org"}, {"url": "http://www.securityfocus.com/bid/74921", "source": "cret@cert.org"}, {"url": "https://bto.bluecoat.com/security-advisory/sa96", "tags": ["Vendor Advisory"], "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, a different vulnerability than CVE-2015-4138."}, {"lang": "es", "value": "El componente WebUI en Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, y SV3800 3.6.x hasta 3.8.x anterior a 3.8.4 no configura el indicador de seguro para la cookie del administrador en una sesi\u00f3n htttps, lo que facilita a atacantes remotos capturar esta cookie mediante la intercepci\u00f3n de su transmisi\u00f3n dentro de una sesi\u00f3n http, una vulnerabilidad diferente a CVE-2015-4138."}], "lastModified": "2016-12-03T03:07:06.280", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:blue_coat:ssl_visibility_appliance_sv800_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A543761-A119-465D-A249-47347CE5EED9", "versionEndIncluding": "3.8.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:blue_coat:ssl_visibility_appliance_sv800:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EB72CFF6-C8B6-429C-A036-2560CAE3C713"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:blue_coat:ssl_visibility_appliance_sv1800_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "658F9B38-DA76-4CF8-961C-DCD596DEC697", "versionEndIncluding": "3.8.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:blue_coat:ssl_visibility_appliance_sv1800:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F280A1EE-FEB6-435E-B566-132E9C2F54C2"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:blue_coat:ssl_visibility_appliance_sv3800_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33E52942-0C82-472D-8065-8D33221285EE", "versionEndIncluding": "3.8.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:blue_coat:ssl_visibility_appliance_sv3800:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E7CA4AEA-C309-4E96-8835-CADB7FA32C05"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:blue_coat:ssl_visibility_appliance_sv2800_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "041A6762-C233-4163-8692-4DE054F1C9EE", "versionEndIncluding": "3.8.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:blue_coat:ssl_visibility_appliance_sv2800:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A6B04FC6-F165-4590-B088-7F126667ACD3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cret@cert.org"}