PT-2024-30361 · Ibm · Ibm Concert

Published 2024-09-12 · Updated 2024-09-20 · CVE-2024-43180

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Concert version 1.0

Description The issue concerns the exposure of sensitive cookie information due to the missing secure attribute on authorization tokens or session cookies. Attackers can exploit this by sending a user a http:// link or by planting this link in a site the user visits, allowing them to obtain the cookie value by snooping the traffic. This could lead to potential data compromise.

Recommendations For IBM Concert version 1.0, upgrade the affected component immediately to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the upgrade is applied.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-614

CWE-319

Related Identifiers

CVE-2024-43180

Affected Products

Ibm Concert

References · 9

• https://osv.dev/vulnerability/CVE-2024-43180 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43180 · Security Note
• https://ibm.com/support/pages/node/7168234 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/351213 · Vendor Advisory
• https://t.me/cvenotify/94467 · Telegram Post
• https://t.me/cvedetector/5532 · Telegram Post
• https://twitter.com/CVEnew/status/1834417202558103923 · Twitter Post
• https://twitter.com/oktsec/status/1834475660661637386 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1834465837668864102 · Twitter Post