4.8
Moyenne
CVE-2024-28770 IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure…
Description
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Security Directory Integrator | 7.2.0 | Pas de correctif indiqué |
| Security Verify Directory Integrator | 10.0.0 | Pas de correctif indiqué |
Autres CVE de Security Directory Integrator
Les 10 CVE de Security Directory Integrator →
CVE-2024-28765
IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote…
5.3
Moyenne
CVE-2024-28766
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could disclose sensitive…
2.4
Faible
CVE-2024-28771
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure…
4.8
Moyenne
CVE-2024-28767
IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3 could allow a remote authenticated…
6.8
Moyenne