PT-2020-11002 · Ibm · Ibm Security Secret Server

Published 2020-01-28 · Updated 2020-01-30 · CVE-2019-4638

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Secret Server version 10.7

Description The issue allows an attacker to obtain sensitive information using man-in-the-middle techniques because the secure attribute is not set on authorization tokens or session cookies.

Recommendations For IBM Security Secret Server version 10.7, consider setting the secure attribute on authorization tokens and session cookies manually as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-565

Related Identifiers

CVE-2019-4638

Affected Products

Ibm Security Secret Server

References · 5

• https://ibm.com/support/pages/node/1283236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4638 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/170044 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-4638 · Vendor Advisory
• https://t.me/cvenotify/556 · Telegram Post