Medium severity · published Jul 1, 2020
CVE-2019-4704
IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 172014.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Security Identity Manager Virtual Appliance · Ibm
7.0.2 · source: NVD
Affected product
SI
Security Identity Manager Virtual Appliance
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-4704
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-4704
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/172014
Patch
https://www.ibm.com/support/pages/node/6242348
More from Security Identity Manager Virtual Appliance
9.8
CVE-2016-0332
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 do not properly restrict failed login attempts, which makes it easier…
8.8
CVE-2016-0324
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to execute arbitrary code with…
7.8
CVE-2019-4676
IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user
7.8
CVE-2016-0327
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows local users to gain administrator privileges via unspecified…
6.1
CVE-2016-9704
IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting