PT-2024-10411 · Ibm · Ibm Security Verify Directory Integrator+1

Published

2024-03-10

·

Updated

2025-07-14

·

CVE-2024-28770

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions IBM Security Directory Integrator version 7.2.0 IBM Security Verify Directory Integrator version 10.0.0
Description The issue is related to the absence of the secure attribute in session cookies, allowing attackers to obtain cookie values by sending a http link to a user or by planting this link in a site the user visits. The cookie will be sent to the insecure link, and the attacker can then obtain the cookie value by snooping the traffic. This may enable remote attackers to gain unauthorized access to protected information.
Recommendations For IBM Security Directory Integrator version 7.2.0, set the secure attribute on authorization tokens or session cookies to prevent exploitation. For IBM Security Verify Directory Integrator version 10.0.0, set the secure attribute on authorization tokens or session cookies to prevent exploitation. As a temporary workaround, consider restricting access to sensitive information until the secure attribute is set on authorization tokens or session cookies.

Fix

Weakness Enumeration

CWE-614

Related Identifiers

BDU:2025-00939
CVE-2024-28770

Affected Products

Ibm Security Directory Integrator
Ibm Security Verify Directory Integrator