Missing HTTPOnly Flag in Set-Cookie Header in IBM Tivoli Endpoint Manager (TEM) before 8.2

CVE-2012-1837 · MEDIUM Severity

AV:N/AC:L/AU:N/C:P/I:N/A:N

The (1) webreports, (2) post/create-role, and (3) post/update-role programs in IBM Tivoli Endpoint Manager (TEM) before 8.2 do not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Learn more about our Cis Benchmark Audit For Ibm I.