CVE-2016-0353

IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ibm:security_privileged_identity_manager:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_privileged_identity_manager:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_privileged_identity_manager:2.0.2:*:*:*:*:*:*:*

History

21 Nov 2024, 02:41

Type Values Removed Values Added
References () http://www-01.ibm.com/support/docview.wss?uid=swg21988706 - Vendor Advisory () http://www-01.ibm.com/support/docview.wss?uid=swg21988706 - Vendor Advisory
References () http://www.securityfocus.com/bid/94543 - () http://www.securityfocus.com/bid/94543 -

Information

Published : 2016-11-24 19:59

Updated : 2024-11-21 02:41


NVD link : CVE-2016-0353

Mitre link : CVE-2016-0353

CVE.ORG link : CVE-2016-0353


JSON object : View

Products Affected

ibm

  • security_privileged_identity_manager
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-254

7PK - Security Features