Not rated
CVE-2016-5953 IBM Sterling Order Management transmits the session identifier within the URL
Description
IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Sterling Order Management | 9.5 | No fix stated |
| Sterling Order Management | 9.4 | No fix stated |
| Sterling Order Management | 9.3 | No fix stated |
| Sterling Order Management 9.2 | 9.2 → 9.2.1 | No fix stated |
| Sterling Order Management | 9.1 | No fix stated |
| Sterling Order Management | 8.5 | No fix stated |
| Sterling Order Management | 8.0 | No fix stated |