CVE-2020-4763 - IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies

Back Back to CVE browser

MEDIUM

IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies

Published Nov 16, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 1.00%

Description

IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 188897.

Affected products

Vendor IBM Product Sterling File Gateway Default
n/a
- Version
  2.2.0.0
  Status
  affected
  Constraints
  -
- Version
  2.2.6.5
  Status
  affected
  Constraints
  -
- Version
  6.0.0.0
  Status
  affected
  Constraints
  -
- Version
  6.0.3.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Sterling File Gateway

n/a

Version	Status	Constraints
2.2.0.0	affected	-
2.2.6.5	affected	-
6.0.0.0	affected	-
6.0.3.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26010
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/188897
vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6368025
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26010		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/188897		vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6368025		x_refsource_CONFIRMVendor Advisory