Session Cookie Security Flaw in IBM Security Identity Manager Appliance
CVE-2019-4704
3.7LOW
Key Information:
- Vendor
- IBM
- Vendor
- CVE Published:
- 1 July 2020
Summary
IBM Security Identity Manager Virtual Appliance 7.0.2 lacks the secure attribute on its authorization tokens and session cookies, leading to a potential security risk. Attackers can exploit this by tricking users into clicking on malicious links, causing cookies to be sent over insecure connections. This could allow adversaries to capture sensitive cookie data by intercepting the network traffic. The issue highlights the need for robust security measures in managing session data to prevent unauthorized access.
Affected Version(s)
Security Identity Manager Virtual Appliance 7.0.2
References
CVSS V3.1
Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved