6.3
Medium
CVE-2024-45651 IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure…
Description
IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Sterling Connect:Direct Web Services | 6.3.0 | No fix stated |
| Sterling Connect:Direct Web Services | 6.2.0 | No fix stated |
| Sterling Connect:Direct Web Services | 6.1.0 | No fix stated |
Other CVEs of Sterling Connect:Direct Web Services
The 7 CVEs of Sterling Connect:Direct Web Services →
CVE-2024-49808
IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity…
6.3
Medium
CVE-2024-45653
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to…
4.3
Medium
CVE-2024-39747
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses default credentials for potentially critical…
8.1
High
CVE-2024-39745
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms…
5.9
Medium