Skip to content
Sign in
5.3 Medium

CVE-2023-33860 IBM Security QRadar EDR 3.12 does not set the secure attribute on authorization tokens or session cookies

Description

IBM Security QRadar EDR 3.12 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

Affected products and versions

Product Affected versions Fixed in
Security QRadar EDR 3.12 No fix stated

Other CVEs of Security QRadar EDR

The 9 CVEs of Security QRadar EDR →
CVE-2024-45636 IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local… 4.1 Medium CVE-2025-36376 IBM Security QRadar EDR 3.12 through 3.12.23 does not invalidate session after a session expiration which could allow an… 6.3 Medium CVE-2025-36377 IBM Security QRadar EDR 3.12 through 3.12.23 does not invalidate session after a session expiration which could allow an… 6.3 Medium CVE-2025-36379 IBM Security QRadar EDR 3.12 through 3.12.23 IBM Security ReaQta uses weaker than expected cryptographic algorithms that… 5.9 Medium
Track this CVE