Session Cookie Security Flaw in IBM i2 Analyst's Notebook Premium
CVE-2021-29769
3.1LOW
Summary
IBM i2 Analyst's Notebook Premium is vulnerable due to its failure to set the secure attribute on authorization tokens and session cookies. This weakness allows malicious actors to potentially capture cookie values by tricking users into accessing an unsecured link. If a user interacts with such a link, the session cookie is sent over an insecure connection, enabling attackers to intercept and exploit the cookie data. This vulnerability underscores the importance of configuring secure attributes for session management in web applications.
Affected Version(s)
i2 Analyze 4.3.0
i2 Analyze 4.3.1
i2 Analyze 4.3.2
References
CVSS V3.1
Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved