Remote Information Disclosure Vulnerability in IBM Security Privileged Identity Manager

CVE-2016-5958

Summary

IBM Security Privileged Identity Manager possesses a vulnerability due to inadequate security measures for session cookies. Specifically, the secure flag is not set for session cookies transmitted in SSL mode, making them susceptible to interception during HTTP sessions. This flaw can be exploited by attackers to capture sensitive information stored in the compromised session cookie. The lack of protection could lead to unauthorized access to confidential data, posing significant security risks for organizations utilizing IBM's solution.

References