CVE-2018-1626

CWE-3843 documents3 sources

Severity

4.3MEDIUM

EPSS

0.1%

top 70.01%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Security Privileged Identity Manager

Timeline

PublishedApr 2

Latest updateMay 13

Description

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 144411.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.6 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5ibm/security_privileged_identity_manager2.1.1

▶NVDibm/security_privileged_identity_manager2.1.1

🔴Vulnerability Details

GHSA

GHSA-v6gf-j6qg-9x4r: IBM Security Privileged Identity Manager Virtual Appliance 2↗2022-05-13

▶

CVEList

CVE-2018-1626: IBM Security Privileged Identity Manager Virtual Appliance 2↗2019-04-02

▶