Lucene search

IbmCVELIST:CVE-2019-4638

HistoryJan 28, 2020 - 6:30 p.m.

CVE-2019-4638

2020-01-2818:30:56

ibm

www.cve.org

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C

AI Score

3.6

Confidence

High

EPSS

0.001

Percentile

24.2%

JSON

IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 170044.

CNA Affected

[
  {
    "product": "Security Secret Server",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "10.7"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/170044

www.ibm.com/support/pages/node/1283236

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C

AI Score

3.6

Confidence

High

EPSS

0.001

Percentile

24.2%

JSON

Related for CVELIST:CVE-2019-4638