CVE-2020-4173 - IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies

Back Back to CVE browser

MEDIUM

IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies

Published Jul 9, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 0.92%

Description

IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 174682.

Affected products

Vendor IBM Product InfoSphere Guardium Activity Monitor Default
n/a
- Version
  10.6
  Status
  affected
  Constraints
  -
- Version
  11.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

InfoSphere Guardium Activity Monitor

n/a

Version	Status	Constraints
10.6	affected	-
11.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25420
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/174682
vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6244924
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25420		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/174682		vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6244924		x_refsource_CONFIRMVendor Advisory