PT-2024-14032 · Ibm · Ibm Powersc

Published 2024-02-01 · Updated 2024-02-12 · CVE-2023-50962

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM PowerSC versions 1.3 through 2.1

Description The issue concerns the lack of implementation of the "HTTP Strict Transport Security" (HSTS) web security policy mechanism in the MFA component. This mechanism is designed to protect against certain types of attacks by ensuring that web browsers only interact with the server over a secure connection. Without HSTS, the system may be more vulnerable to attacks that rely on manipulating or intercepting HTTP connections.

Recommendations For IBM PowerSC versions 1.3 through 2.1, consider implementing the HSTS policy mechanism to enhance the security of the MFA component. As a temporary workaround, restrict access to sensitive resources and ensure that all interactions with the system are conducted over secure connections. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-50962

Affected Products

Ibm Powersc

References · 9

• https://ibm.com/support/pages/node/7113759 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/276004 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50962 · Security Note
• https://t.me/cvenotify/71032 · Telegram Post
• https://t.me/cvenotify/69722 · Telegram Post
• https://twitter.com/RedPacketSec/status/1753359019740123619 · Twitter Post
• https://twitter.com/CVEnew/status/1753236360918393116 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1753310510626361808 · Twitter Post