Session Cookie Vulnerability in IBM Security QRadar SIEM

CVE-2014-4830

Summary

A vulnerability exists in IBM Security QRadar SIEM affecting specific versions of QRM and QVM. The application does not set the HTTPOnly flag for session cookies within the Set-Cookie header. This oversight allows remote attackers to exploit the absence of this security measure, potentially leading to unauthorized access to sensitive session information through client-side scripts. Proper implementation of the HTTPOnly flag is crucial in safeguarding session cookies from being accessed by malicious scripts, thereby enhancing the overall security posture of affected applications.

References