PT-2023-26386 · Ibm · Ibm Cics Tx Advanced

Published 2023-11-13 · Updated 2023-11-17 · CVE-2023-38363

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM CICS TX Advanced version 10.1

Description The issue arises because IBM CICS TX Advanced does not set the secure attribute on authorization tokens or session cookies. This allows attackers to potentially obtain cookie values by sending a user a http:// link or by embedding such a link in a website the user visits. Once the user clicks the link, the cookie is sent to the insecure link, and the attacker can then intercept the cookie value by monitoring the traffic.

Recommendations For IBM CICS TX Advanced version 10.1, set the secure attribute on authorization tokens and session cookies to prevent them from being sent over insecure connections. As a temporary workaround, consider restricting access to sensitive operations that rely on these cookies until the secure attribute is properly set. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2023-38363

Affected Products

Ibm Cics Tx Advanced

References · 5

• https://ibm.com/support/pages/node/7067987 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38363 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/260818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38363 · Security Note
• https://t.me/cvenotify/60577 · Telegram Post