Unauthorized Cookie Exposure in IBM Security Directory Integrator

CVE-2024-28771

Summary

IBM Security Directory Integrator and IBM Security Verify Directory Integrator are vulnerable due to improper management of authorization tokens and session cookies. Specifically, the secure attribute is not set, which allows attackers to exploit this weakness. By crafting malicious links and disseminating them to unsuspecting users, attackers can potentially intercept cookie values through unsecured connections. This vulnerability can lead to session hijacking, where unauthorized individuals gain access to sensitive user data.

References