Session Cookie Security Flaw in IBM Security Identity Manager Appliance

CVE-2019-4704

Summary

IBM Security Identity Manager Virtual Appliance 7.0.2 lacks the secure attribute on its authorization tokens and session cookies, leading to a potential security risk. Attackers can exploit this by tricking users into clicking on malicious links, causing cookies to be sent over insecure connections. This could allow adversaries to capture sensitive cookie data by intercepting the network traffic. The issue highlights the need for robust security measures in managing session data to prevent unauthorized access.

References