PT-2019-17153 · Ibm · Ibm Financial Transaction Manager

Published 2019-12-20 · Updated 2019-12-22 · CVE-2019-4743

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager version 3.0

Description The issue allows attackers to obtain cookie values by exploiting the lack of secure attribute setting on authorization tokens or session cookies. This can be achieved by sending an http link to a user or planting it on a site the user visits, causing the cookie to be sent to the insecure link. The attacker can then snoop the traffic to obtain the cookie value.

Recommendations For IBM Financial Transaction Manager version 3.0, consider setting the secure attribute on authorization tokens or session cookies to prevent them from being sent over insecure connections. As a temporary workaround, restrict access to sensitive areas of the application that use these cookies to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2019-4743

Affected Products

Ibm Financial Transaction Manager

References · 4

• https://osv.dev/vulnerability/CVE-2019-4743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4743 · Security Note
• https://ibm.com/support/pages/node/1135173 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/172880 · Vendor Advisory