Session Cookie Security Flaw in IBM Security Identity Manager Appliance
CVE-2019-4704

3.7LOW

Key Information:

Vendor
IBM
Vendor
CVE Published:
1 July 2020

Summary

IBM Security Identity Manager Virtual Appliance 7.0.2 lacks the secure attribute on its authorization tokens and session cookies, leading to a potential security risk. Attackers can exploit this by tricking users into clicking on malicious links, causing cookies to be sent over insecure connections. This could allow adversaries to capture sensitive cookie data by intercepting the network traffic. The issue highlights the need for robust security measures in managing session data to prevent unauthorized access.

Affected Version(s)

Security Identity Manager Virtual Appliance 7.0.2

References

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.