PT-2018-14327 · Ibm · Ibm Security Access Manager Appliance

Published 2018-12-13 · Updated 2019-10-09 · CVE-2018-1804

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager Appliance versions 9.0.1.0 through 9.0.5.0

Description The issue allows an attacker to obtain sensitive information using man-in-the-middle techniques because the secure attribute is not set on authorization tokens or session cookies.

Recommendations For versions 9.0.1.0 through 9.0.5.0, consider configuring the system to set the secure attribute on authorization tokens and session cookies to prevent sensitive information from being obtained by an attacker. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2018-1804

Affected Products

Ibm Security Access Manager Appliance

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-1804 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1804 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=ibm10787785 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/149703 · Vendor Advisory