PT-2023-24515 · Ibm · Ibm Txseries For Multiplatforms+2

Published 2023-06-08 · Updated 2023-06-16 · CVE-2023-33847

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM TXSeries for Multiplatforms versions 8.1 through 9.1 CICS TX Standard version 11.1 CICS TX Advanced versions 10.1 through 11.1

Description The issue arises because the software does not set the secure attribute on authorization tokens or session cookies. This allows attackers to potentially obtain cookie values by sending a user a http:// link or by planting this link in a site the user visits. The cookie will be sent to the insecure link, and the attacker can then obtain the cookie value by snooping the traffic.

Recommendations For IBM TXSeries for Multiplatforms versions 8.1 through 9.1, consider configuring the software to set the secure attribute on authorization tokens and session cookies. For CICS TX Standard version 11.1, update the configuration to ensure the secure attribute is set for authorization tokens and session cookies. For CICS TX Advanced versions 10.1 through 11.1, modify the settings to include the secure attribute on authorization tokens and session cookies.

Fix

Related Identifiers

CVE-2023-33847

Affected Products

Cics Tx Advanced

Cics Tx Standard

Ibm Txseries For Multiplatforms

References · 8

• https://ibm.com/support/pages/node/7001641 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33847 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/257102 · Vendor Advisory
• https://ibm.com/support/pages/node/7001635 · Vendor Advisory
• https://ibm.com/support/pages/node/7001645 · Vendor Advisory
• https://t.me/cvenotify/51998 · Telegram Post
• https://t.me/cvenotify/52501 · Telegram Post