PT-2019-16969 · Ibm · Ibm Smartcloud Analytics

Publicado 2019-11-22 · Atualizado 2020-08-24 · CVE-2019-4214

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM SmartCloud Analytics versions 1.3.1 through 1.3.5

Description The issue allows an attacker to obtain sensitive information using man-in-the-middle techniques because it does not set the secure attribute on authorization tokens or session cookies.

Recommendations For IBM SmartCloud Analytics versions 1.3.1 through 1.3.5, consider updating the software to a version that sets the secure attribute on authorization tokens or session cookies to prevent sensitive information from being obtained by an attacker.

Correção

Incorrect Permission

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-732

CWE-311

Identificadores relacionados

CVE-2019-4214

Produtos afetados

Ibm Smartcloud Analytics

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-4214 · Nota de Segurança
• https://ibm.com/support/pages/node/1110171 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/159185 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-4214 · Aviso do Fabricante