Session Cookie Security Flaw in IBM Sterling File Gateway

CVE-2020-4665

Summary

The IBM Sterling File Gateway has a security vulnerability where the secure attribute is not set on authorization tokens and session cookies. This oversight allows attackers to exploit the vulnerability by sending malicious links to unsuspecting users. When users click on these links, their cookies are sent over insecure HTTP connections, potentially allowing attackers to intercept sensitive cookie values through traffic snooping. It is crucial for users and administrators of affected versions to implement mitigation strategies to protect against unauthorized access to sensitive session information.

References