PT-2022-10870 · Ibm · Ibm Financial Transaction Manager

Published 2022-02-02 · Updated 2022-02-05 · CVE-2021-39066

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager version 3.2.4

Description The issue allows an attacker to steal authenticated sessions because it does not invalidate any existing session identifier.

Recommendations For IBM Financial Transaction Manager version 3.2.4, consider implementing a session invalidation mechanism to prevent session theft until a patch is available. As a temporary workaround, restrict access to sensitive areas of the application that rely on authenticated sessions to minimize the risk of exploitation.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2021-39066

Affected Products

Ibm Financial Transaction Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-39066 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/215040 · Vendor Advisory
• https://ibm.com/support/pages/node/6527892 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39066 · Vendor Advisory
• https://t.me/cibsecurity/36692 · Telegram Post
• https://t.me/cvenotify/26314 · Telegram Post