IBM Sterling B2B Integrator Vulnerability: Unsecured Authorization Tokens and Session Cookies

CVE-2023-42016

Summary

In IBM Sterling B2B Integrator, a security vulnerability exists due to the absence of the secure attribute on authorization tokens and session cookies. This issue allows potential attackers to intercept cookie values through crafted HTTP links, leading to unauthorized access if users click on these links. When a user visits a malicious site or link, the cookies can be relayed over an insecure connection, where attackers can snoop on the traffic and capture sensitive data. This flaw emphasizes the importance of implementing robust security measures to safeguard sensitive information and prevent unauthorized access.

References