PT-2018-14327 · Ibm · Ibm Security Access Manager Appliance

Publicado 2018-12-13 · Atualizado 2019-10-09 · CVE-2018-1804

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager Appliance versions 9.0.1.0 through 9.0.5.0

Description The issue allows an attacker to obtain sensitive information using man-in-the-middle techniques because the secure attribute is not set on authorization tokens or session cookies.

Recommendations For versions 9.0.1.0 through 9.0.5.0, consider configuring the system to set the secure attribute on authorization tokens and session cookies to prevent sensitive information from being obtained by an attacker. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2018-1804

Produtos afetados

Ibm Security Access Manager Appliance

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-1804 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1804 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=ibm10787785 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/149703 · Aviso do Fabricante