Remote Information Disclosure in IBM Jazz Team Server
CVE-2021-38879

3.7LOW

Key Information:

Vendor
IBM
Status
Jazz Team Server
Vendor
CVE Published:
24 June 2022

Summary

A vulnerability in IBM Jazz Team Server could allow a remote attacker to access sensitive information due to the absence of the HTTPOnly flag on cookies. This oversight may expose critical data, enabling exploitation by adversaries. Affected versions include 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2. Users are advised to investigate the implementation of cookie security measures to mitigate potential risks.

Affected Version(s)

Jazz Team Server 6.0.6

Jazz Team Server 6.0.6.1

Jazz Team Server 7.0

References

https://www.ibm.com/support/pages/node/6597501
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/209057
vdb-entryx_refsource_XF

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.