Session Cookie Security Flaw in IBM Sterling File Gateway
CVE-2020-4665
4.3MEDIUM
Summary
The IBM Sterling File Gateway has a security vulnerability where the secure attribute is not set on authorization tokens and session cookies. This oversight allows attackers to exploit the vulnerability by sending malicious links to unsuspecting users. When users click on these links, their cookies are sent over insecure HTTP connections, potentially allowing attackers to intercept sensitive cookie values through traffic snooping. It is crucial for users and administrators of affected versions to implement mitigation strategies to protect against unauthorized access to sensitive session information.
Affected Version(s)
Sterling File Gateway 2.2.0.0
Sterling File Gateway 6.0.3.2
Sterling File Gateway 2.2.6.5
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved