CVE-2012-1837: The (1) webreports, (2) post/create-role, and (3) post/update-role programs in IBM Tivoli Endpoint Manager...

Security readout for executives and security teams

IBM Tivoli Endpoint Manager before 8.2 set at least one cookie without the HTTPOnly protection. That can make cookie theft easier if an attacker can get script running in a user's browser session. The bundle does not provide CVSS, confirmed exploitation, or detailed impact beyond potentially sensitive information exposure. Exposure is limited to IBM Tivoli Endpoint Manager deployments before version 8.2, specifically the named web reports and role-management programs. Risk is higher where administrative web interfaces are reachable by many users or untrusted networks. The bundle does not identify other affected products or versions. Schedule remediation as a moderate-priority legacy platform issue. It is not reported as actively exploited, but it weakens session protection around endpoint management administration, which can carry high operational sensitivity if exposed or combined with another browser-side attack. Mitigation focus: Inventory IBM Tivoli Endpoint Manager instances and identify versions older than 8.2.; Review IBM guidance for the fixed or supported upgrade path.; Restrict access to TEM administrative web interfaces to trusted networks and users..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.