PT-2019-17153 · Ibm · Ibm Financial Transaction Manager

Publicado 2019-12-20 · Atualizado 2019-12-22 · CVE-2019-4743

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager version 3.0

Description The issue allows attackers to obtain cookie values by exploiting the lack of secure attribute setting on authorization tokens or session cookies. This can be achieved by sending an http link to a user or planting it on a site the user visits, causing the cookie to be sent to the insecure link. The attacker can then snoop the traffic to obtain the cookie value.

Recommendations For IBM Financial Transaction Manager version 3.0, consider setting the secure attribute on authorization tokens or session cookies to prevent them from being sent over insecure connections. As a temporary workaround, restrict access to sensitive areas of the application that use these cookies to minimize the risk of exploitation.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2019-4743

Produtos afetados

Ibm Financial Transaction Manager

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-4743 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-4743 · Nota de Segurança
• https://ibm.com/support/pages/node/1135173 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/172880 · Aviso do Fabricante