Session Cookie Vulnerability in IBM Security Guardium Data Encryption

CVE-2019-4686

Summary

A vulnerability exists in IBM Security Guardium Data Encryption 3.0.0.2 where the secure attribute is not set on authorization tokens and session cookies. This oversight allows attackers to capture cookie values through an insecure HTTP connection. By tricking users into clicking a malicious link, an attacker can intercept the cookie data, potentially compromising sensitive sessions. Users are at risk of unauthorized access to protected resources.

References