4.8
Medium
CVE-2024-28771 IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure…
Description
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Security Directory Integrator | 7.2.0 | No fix stated |
| Security Verify Directory Integrator | 10.0.0 | No fix stated |
Other CVEs of Security Directory Integrator
The 10 CVEs of Security Directory Integrator →
CVE-2024-28765
IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote…
5.3
Medium
CVE-2024-28766
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could disclose sensitive…
2.4
Low
CVE-2024-28770
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure…
4.8
Medium
CVE-2024-28767
IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3 could allow a remote authenticated…
6.8
Medium