CVE-2019-4638 — Reliance on Cookies without Validation and Integrity Checking in IBM Security Secret Server

CWE-565 — Reliance on Cookies without Validation and Integrity Checking3 documents3 sources
Severity
3.7LOWNVD
EPSS
0.3%
top 48.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Security Secret Server
Timeline
PublishedJan 28
Latest updateMay 24

Description

IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 170044.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages2 packages

▶NVDibm/security_secret_server< 10.7.000059

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-q2pp-q5j6-9xfm: IBM Security Secret Server 10↗2022-05-24
▶
CVEList
CVE-2019-4638: IBM Security Secret Server 10↗2020-01-28
▶