CVE-2013-3984: Infoleak
First published: Mon May 26 2014(Updated: )
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HCL Sametime | =8.0.0.0 | |
| HCL Sametime | =8.0.1.0 | |
| HCL Sametime | =8.0.1.1 | |
| HCL Sametime | =8.0.2.0 | |
| HCL Sametime | =8.0.2.1 | |
| HCL Sametime | =8.5.0.0 | |
| HCL Sametime | =8.5.1.0 | |
| HCL Sametime | =8.5.1.1 | |
| HCL Sametime | =8.5.2.0 | |
| HCL Sametime | =8.5.2.1 | |
| HCL Sametime | =9.0.0.0 | |
| =8.0.0.0 | ||
| =8.0.1.0 | ||
| =8.0.1.1 | ||
| =8.0.2.0 | ||
| =8.0.2.1 | ||
| =8.5.0.0 | ||
| =8.5.1.0 | ||
| =8.5.1.1 | ||
| =8.5.2.0 | ||
| =8.5.2.1 | ||
| =9.0.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-3984?
CVE-2013-3984 is considered to have a medium severity as it may allow remote attackers to intercept sensitive cookie data.
How do I fix CVE-2013-3984?
To fix CVE-2013-3984, ensure that the secure flag is set for cookies transmitted over HTTPS in the affected IBM Sametime versions.
Which versions of IBM Sametime are affected by CVE-2013-3984?
CVE-2013-3984 affects IBM Sametime versions 8.x (up to 8.5.2.1) and 9.x (up to 9.0.0.1).
What happens if CVE-2013-3984 is exploited?
If exploited, CVE-2013-3984 allows attackers to capture cookies, potentially compromising user sessions and sensitive information.
Is there a patch available for CVE-2013-3984?
Yes, IBM has released updates to address CVE-2013-3984 in the affected versions of Sametime.
- agent/references
- agent/type
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/severity
- agent/weakness
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/event
- agent/tags
- vendor/ibm
- canonical/hcl sametime
- version/hcl sametime/8.0.0.0
- version/hcl sametime/8.0.1.0
- version/hcl sametime/8.0.1.1
- version/hcl sametime/8.0.2.0
- version/hcl sametime/8.0.2.1
- version/hcl sametime/8.5.0.0
- version/hcl sametime/8.5.1.0
- version/hcl sametime/8.5.1.1
- version/hcl sametime/8.5.2.0
- version/hcl sametime/8.5.2.1
- version/hcl sametime/9.0.0.0