PT-2020-17976 · Ibm · Ibm Security Information Queue

Chris Shepherd + 7 · Published 2020-04-08 · Updated 2021-07-21 · CVE-2020-4289

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Information Queue (ISIQ) versions 1.0.0 through 1.0.5

Description The issue is caused by the failure to set the HTTPOnly flag, allowing a remote attacker to obtain sensitive information from the cookie.

Recommendations For IBM Security Information Queue (ISIQ) versions 1.0.0 through 1.0.5, set the HTTPOnly flag to prevent sensitive information from being accessed.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2020-4289

Affected Products

Ibm Security Information Queue

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/176332 · Vendor Advisory
• https://ibm.com/support/pages/node/6172593 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4289 · Security Note