CVE-2024-39734 - IBM Datacap Navigator information disclosure

Back Back to CVE browser

MEDIUM

IBM Datacap Navigator information disclosure

Published Jul 14, 2024

4.3

MEDIUM

CVSS 3.1

EPSS 0.23%

Description

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 296001.

Affected products

Vendor IBM Product Datacap Navigator Default
unaffected
- Version
  9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Datacap Navigator

unaffected

Version	Status	Constraints
9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-565

CWE-614

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38214
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/296001
vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7160185
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38214		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/296001		vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7160185		vendor-advisoryVendor Advisory