PT-2019-16969 · Ibm · Ibm Smartcloud Analytics

Published 2019-11-22 · Updated 2020-08-24 · CVE-2019-4214

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM SmartCloud Analytics versions 1.3.1 through 1.3.5

Description The issue allows an attacker to obtain sensitive information using man-in-the-middle techniques because it does not set the secure attribute on authorization tokens or session cookies.

Recommendations For IBM SmartCloud Analytics versions 1.3.1 through 1.3.5, consider updating the software to a version that sets the secure attribute on authorization tokens or session cookies to prevent sensitive information from being obtained by an attacker.

Fix

Incorrect Permission

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-732

CWE-311

Related Identifiers

CVE-2019-4214

Affected Products

Ibm Smartcloud Analytics

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-4214 · Security Note
• https://ibm.com/support/pages/node/1110171 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/159185 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-4214 · Vendor Advisory