PT-2018-4619 · Ibm · Ibm Security Identity Manager Virtual Appliance

Chris Shepherd + 6 · Publicado 2018-02-21 · Atualizado 2018-03-13 · CVE-2016-0351

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Identity Manager Virtual Appliance versions 7.0.x before 7.0.1.3-ISS-SIM-IF0001

Description The issue makes it easier for remote attackers to capture session cookies by intercepting their transmission within an HTTP session, as the secure flag for the session cookie in an HTTPS session is not set.

Recommendations For IBM Security Identity Manager Virtual Appliance versions 7.0.x before 7.0.1.3-ISS-SIM-IF0001, update to version 7.0.1.3-ISS-SIM-IF0001 or later to resolve the issue. As a temporary workaround, consider restricting access to HTTPS sessions to minimize the risk of cookie interception.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-0351

Produtos afetados

Ibm Security Identity Manager Virtual Appliance

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/111890 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21989198 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0351 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-0351 · Aviso do Fabricante