Session Fixation Vulnerability in IBM MQ Appliance

CVE-2021-38986

What is CVE-2021-38986?

The IBM MQ Appliance version 9.2 CD and 9.2 LTS contains a session fixation vulnerability that fails to invalidate a user's session after logout. This design flaw can potentially allow an authenticated user to preserve their session and impersonate another user within the system, leading to unauthorized access to sensitive information and actions. Organizations utilizing these versions should take immediate action to mitigate the risk associated with user impersonation.

References