PT-2021-18532 · Ibm · Ibm Transformation Extender Advanced

Published 2021-10-21 · Updated 2022-07-12 · CVE-2021-29883

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Transformation Extender Advanced versions 9.0 through 10.0

Description The issue arises because the secure attribute is not set on authorization tokens or session cookies. This allows attackers to potentially obtain cookie values by sending a user an http link or by embedding such a link in a website the user visits. The cookie is sent to the insecure link, and the attacker can then snoop the traffic to obtain the cookie value.

Recommendations For versions 9.0 and 10.0, ensure that the secure attribute is set on authorization tokens and session cookies to prevent them from being sent over insecure connections. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2021-29883

Affected Products

Ibm Transformation Extender Advanced

References · 5

• https://osv.dev/vulnerability/CVE-2021-29883 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/207090 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29883 · Security Note
• https://ibm.com/support/pages/node/6507077 · Vendor Advisory
• https://t.me/cibsecurity/30958 · Telegram Post