High severity · published Oct 1, 2025
CVE-2023-49881
IBM Transformation Extender Advanced session fixation
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
IBM Transformation Extender Advanced 10.0.1
does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
Transformation Extender Advanced · IBM
10.0.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49881
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49881
Vendor Advisory
https://www.ibm.com/support/pages/node/7246882
More from Transformation Extender Advanced
9.8
CVE-2023-49886
IBM Transformation Extender Advanced code execution
7.5
CVE-2023-49883
IBM Transformation Extender Advanced information disclosure
7.1
CVE-2017-1758
IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM…
6.2
CVE-2023-50300
IBM Transformation Extender Advanced improper access control
4.4
CVE-2023-50301
IBM Transformation Extender Advanced information disclosure