Session fixation

2019-02-0421:29:00

PRIOn knowledge base

www.prio-n.com

3.1 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658.

CPENameOperatorVersion
security_identity_managerge7.0.1
security_identity_managerle7.0.1.10

CPE	Name	Operator	Version
	security_identity_manager	ge	7.0.1
	security_identity_manager	le	7.0.1.10

References

www.ibm.com/support/docview.wss?uid=ibm10796380

www.securityfocus.com/bid/106854

exchange.xforce.ibmcloud.com/vulnerabilities/153658