CVE-2019-4214

CWE-311CWE-732 — Incorrect Permission Assignment3 documents3 sources
Severity
3.7LOW
EPSS
0.2%
top 63.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Smartcloud Analytics LOG AnalysisIBM Smartcloud Analytics
Timeline
PublishedNov 22
Latest updateMay 24

Description

IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 159185.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5ibm/smartcloud_analytics5 versions+4

🔴Vulnerability Details

2
GHSA
GHSA-pw64-x6q9-r7wg: IBM SmartCloud Analytics 1↗2022-05-24
▶
CVEList
CVE-2019-4214: IBM SmartCloud Analytics 1↗2019-11-22
▶