Session Identifier Exposure in IBM Sterling Order Management
CVE-2016-5953

3.7LOW

Key Information:

Vendor

IBM
Status
Sterling Order Management
Vendor
CVE Published:
1 February 2017

What is CVE-2016-5953?

IBM Sterling Order Management has a security issue where session identifiers are transmitted within the URL. When users attempt to access certain views without the necessary permissions, the system generates an error page that inadvertently exposes the encoded session identifier in Base64 format within the URL. This exposure can potentially lead to session hijacking if an attacker obtains the URL. It is crucial for users to implement proper security measures to prevent unauthorized access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Sterling Order Management 8.5

Sterling Order Management 8.0

Sterling Order Management 9.1

References

http://www.ibm.com/support/docview.wss?uid=swg21994521
x_refsource_CONFIRM
http://www.securityfocus.com/bid/95431
vdb-entryx_refsource_BID

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.