Information Disclosure in IBM Rational Build Forge from HTTP Redirection

CVE-2011-1839

Summary

IBM Rational Build Forge version 7.1.0 is vulnerable due to the use of the HTTP GET method in the redirection process from the authentication servlet to a PHP script. This design flaw allows context-dependent attackers to potentially expose session IDs by accessing web server logs, including access logs, Referer logs, or via the user's browser history. This could lead to unauthorized access and compromise user sessions, emphasizing the importance of secure coding practices and the need for updates to mitigate such vulnerabilities.

References