CVE-2014-0905: IBM InfoSphere BigInsights 2.0 through 2.1.2 does not set the secure flag for the LTPA cookie in an https s...

Security readout for executives and security teams

IBM InfoSphere BigInsights 2.0 through 2.1.2 could expose an LTPA session cookie because the cookie was not marked Secure during HTTPS use. If that cookie is later sent over HTTP, a network-positioned attacker may capture it and potentially abuse the session. Exposure is limited to organizations still running IBM InfoSphere BigInsights 2.0 through 2.1.2, especially where users can reach related services over HTTP as well as HTTPS. Treat as a targeted session-protection issue, not a mass-exploitation emergency based on supplied evidence. Prioritize if affected BigInsights systems remain reachable by users or networks where HTTP interception is plausible. Mitigation focus: Identify any IBM InfoSphere BigInsights 2.0 through 2.1.2 deployments.; Review IBM advisory swg21680830 for supported fixes or upgrade guidance.; Disable or restrict HTTP access paths where feasible..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.