PT-2020-18171 · Ibm · Ibm Cloud Pak For Security

Published 2020-11-30 · Updated 2021-07-21 · CVE-2020-4625

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Security version 1.3.0.1(CP4S)

Description The issue is caused by the failure to set the HTTPOnly flag, allowing a remote attacker to obtain sensitive information. A remote attacker could exploit this to obtain sensitive information from the cookie.

Recommendations For IBM Cloud Pak for Security version 1.3.0.1(CP4S), set the HTTPOnly flag to prevent sensitive information from being accessed.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2020-4625

Affected Products

Ibm Cloud Pak For Security

References · 4

• https://ibm.com/support/pages/node/6372536 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4625 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/185360 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4625 · Security Note