Session Cookie Security Flaw in IBM i2 Analyst's Notebook Premium

CVE-2021-29769

What is CVE-2021-29769?

IBM i2 Analyst's Notebook Premium is vulnerable due to its failure to set the secure attribute on authorization tokens and session cookies. This weakness allows malicious actors to potentially capture cookie values by tricking users into accessing an unsecured link. If a user interacts with such a link, the session cookie is sent over an insecure connection, enabling attackers to intercept and exploit the cookie data. This vulnerability underscores the importance of configuring secure attributes for session management in web applications.

References