PT-2019-16932 · Ibm · Ibm Security Access Manager

Published 2019-06-25 · Updated 2023-02-03 · CVE-2019-4152

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager versions 9.0.1 through 9.0.6

Description The issue is related to the improper invalidation of session tokens, which may allow attackers with local access to log into a closed browser session due to the lack of timely session expiration.

Recommendations For versions 9.0.1 through 9.0.6, consider implementing a workaround to enforce proper session expiration and invalidation of session tokens to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2019-4152

Affected Products

Ibm Security Access Manager

References · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/158515 · Vendor Advisory
• https://ibm.com/support/docview.wss?uid=ibm10888379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4152 · Security Note
• https://osv.dev/vulnerability/CVE-2019-4152 · Vendor Advisory
• https://t.me/cvenotify/43585 · Telegram Post