CVE-2017-1368
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 126861.
IBM Security Identity Governance Virtual Appliance, desde la versión 5.2 hasta la 5.2.3.2, no establece el atributo secure en los tokens de autorización o las cookies de sesión. Los atacantes podrían ser capaces de obtener el valor de las cookies mediante el envío de un enlace http:// a un usuario o colocando este enlace en un sitio que visita el usuario. La cookie se enviará al enlace inseguro y el atacante podrá entonces obtener el valor de la cookie rastreando el tráfico. IBM X-Force ID: 126861.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-11-30 CVE Reserved
- 2018-08-06 CVE Published
- 2023-12-28 EPSS Updated
- 2024-09-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-384: Session Fixation
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/126861 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.ibm.com/support/docview.wss?uid=swg22016869 | 2019-10-09 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ibm Search vendor "Ibm" | Security Identity Governance And Intelligence Search vendor "Ibm" for product "Security Identity Governance And Intelligence" | 5.2 Search vendor "Ibm" for product "Security Identity Governance And Intelligence" and version "5.2" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Security Identity Governance And Intelligence Search vendor "Ibm" for product "Security Identity Governance And Intelligence" | 5.2.1 Search vendor "Ibm" for product "Security Identity Governance And Intelligence" and version "5.2.1" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Security Identity Governance And Intelligence Search vendor "Ibm" for product "Security Identity Governance And Intelligence" | 5.2.2 Search vendor "Ibm" for product "Security Identity Governance And Intelligence" and version "5.2.2" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Security Identity Governance And Intelligence Search vendor "Ibm" for product "Security Identity Governance And Intelligence" | 5.2.2.1 Search vendor "Ibm" for product "Security Identity Governance And Intelligence" and version "5.2.2.1" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Security Identity Governance And Intelligence Search vendor "Ibm" for product "Security Identity Governance And Intelligence" | 5.2.3 Search vendor "Ibm" for product "Security Identity Governance And Intelligence" and version "5.2.3" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Security Identity Governance And Intelligence Search vendor "Ibm" for product "Security Identity Governance And Intelligence" | 5.2.3.1 Search vendor "Ibm" for product "Security Identity Governance And Intelligence" and version "5.2.3.1" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Security Identity Governance And Intelligence Search vendor "Ibm" for product "Security Identity Governance And Intelligence" | 5.2.3.2 Search vendor "Ibm" for product "Security Identity Governance And Intelligence" and version "5.2.3.2" | - |
Affected
| ||||||