PT-2011-3401 · Ibm · Ibm Rational Build Forge

Publicado 2011-04-28 · Atualizado 2017-08-17 · CVE-2011-1839

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Rational Build Forge version 7.1.0

Description The issue allows context-dependent attackers to discover session IDs by reading web-server access logs, web-server Referer logs, or the browser history. This is due to the use of the HTTP GET method during redirection from the authentication servlet to a PHP script.

Recommendations For IBM Rational Build Forge version 7.1.0, consider modifying the authentication process to use a more secure method, such as the HTTP POST method, to prevent session IDs from being logged or stored in the browser history. As a temporary workaround, restrict access to web-server logs and the browser history to minimize the risk of session ID discovery.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-1839

Produtos afetados

Ibm Rational Build Forge

Referências · 4

• http://ibm.com/support/docview.wss?uid=swg1PM29655 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66714 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1839 · Nota de Segurança
• http://vupen.com/english/advisories/2011/0919 · Aviso do Fabricante