Session Cookie Vulnerability in IBM Security Identity Governance and Intelligence
CVE-2018-1948
Key Information:
- Vendor
- IBM
- Vendor
- CVE Published:
- 21 February 2019
Summary
A vulnerability exists in IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 where the secure attribute is not properly set on authorization tokens or session cookies. This flaw may allow attackers to exploit the system by tricking users into clicking on malicious links that lead to insecure HTTP sites. When a user accesses such a link, the session cookie can be exposed through traffic interception, enabling attackers to hijack active sessions. IBM X-Force ID: 153428 highlights the need for the implementation of secure cookie practices to mitigate this risk.
Affected Version(s)
Security Identity Governance and Intelligence 5.2
Security Identity Governance and Intelligence 5.2.1
Security Identity Governance and Intelligence 5.2.2
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved