PT-2020-18129 · Ibm · Ibm Financial Transaction Manager

Published 2020-12-21 · Updated 2020-12-22 · CVE-2020-4555

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

S:U/UI:N/AV:N/PR:L/AC:L/I:L/C:L/A:L

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager versions 3.0.6 through 3.1.0

Description The issue allows an authenticated user to impersonate another user on the system due to the failure to invalidate the session after logout.

Recommendations For IBM Financial Transaction Manager versions 3.0.6 through 3.1.0, consider implementing a custom session invalidation mechanism after user logout as a temporary workaround until a patch is available.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2020-4555

Affected Products

Ibm Financial Transaction Manager

References · 9

• https://ibm.com/support/pages/node/6388702 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/183328 · Vendor Advisory
• https://ibm.com/support/pages/node/6388722 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4555 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4555 · Security Note
• https://ibm.com/support/pages/node/6388708 · Vendor Advisory
• https://ibm.com/support/pages/node/6388744 · Vendor Advisory
• https://ibm.com/support/pages/node/6388704 · Vendor Advisory
• https://ibm.com/support/pages/node/6388706 · Vendor Advisory