CVE-2023-42016
IBM Sterling B2B Integrator information disclosure
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 265559.
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 a 6.0.3.8 y 6.1.0.0 a 6.1.2.3 no establece el atributo seguro en tokens de autorización o cookies de sesión. Los atacantes pueden obtener los valores de las cookies enviando un enlace http:// a un usuario o colocando este enlace en un sitio al que accede el usuario. La cookie se enviará al enlace inseguro y el atacante podrá obtener el valor de la cookie espiando el tráfico. ID de IBM X-Force: 265559.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2023-09-06 CVE Reserved
- 2024-02-09 CVE Published
- 2024-02-15 EPSS Updated
- 2024-08-22 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-319: Cleartext Transmission of Sensitive Information
- CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CAPEC
References (2)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.ibm.com/support/pages/node/7116083 | 2024-02-15 |
URL | Date | SRC |
---|---|---|
https://exchange.xforce.ibmcloud.com/vulnerabilities/265559 | 2024-02-15 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Ibm Search vendor "Ibm" | Sterling B2b Integrator Search vendor "Ibm" for product "Sterling B2b Integrator" | >= 6.0.0.0 <= 6.0.3.8 Search vendor "Ibm" for product "Sterling B2b Integrator" and version " >= 6.0.0.0 <= 6.0.3.8" | standard |
Affected
| ||||||
Ibm Search vendor "Ibm" | Sterling B2b Integrator Search vendor "Ibm" for product "Sterling B2b Integrator" | >= 6.1.0.0 <= 6.1.2.3 Search vendor "Ibm" for product "Sterling B2b Integrator" and version " >= 6.1.0.0 <= 6.1.2.3" | standard |
Affected
|