PT-2024-13219 · Ibm · Ibm Engineering Lifecycle Optimization - Publishing

Published 2024-02-08 · Updated 2024-02-15 · CVE-2023-45187

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Engineering Lifecycle Optimization - Publishing versions 7.0.2 through 7.0.3

Description The issue allows an authenticated user to impersonate another user on the system due to the failure to invalidate session after logout.

Recommendations For versions 7.0.2 and 7.0.3, consider implementing a workaround to manually invalidate sessions after logout until a patch is available. As a temporary workaround, consider restricting access to sensitive features that could be exploited by an impersonated user. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2023-45187

Affected Products

Ibm Engineering Lifecycle Optimization - Publishing

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-45187 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45187 · Vendor Advisory
• https://ibm.com/support/pages/node/7116045 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/268749 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1755847974167457861 · Twitter Post
• https://twitter.com/RedPacketSec/status/1755895734136680469 · Twitter Post