CVE-2013-3984: Infoleak
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-3984?
CVE-2013-3984 is considered to have a medium severity as it may allow remote attackers to intercept sensitive cookie data.
How do I fix CVE-2013-3984?
To fix CVE-2013-3984, ensure that the secure flag is set for cookies transmitted over HTTPS in the affected IBM Sametime versions.
Which versions of IBM Sametime are affected by CVE-2013-3984?
CVE-2013-3984 affects IBM Sametime versions 8.x (up to 8.5.2.1) and 9.x (up to 9.0.0.1).
What happens if CVE-2013-3984 is exploited?
If exploited, CVE-2013-3984 allows attackers to capture cookies, potentially compromising user sessions and sensitive information.
Is there a patch available for CVE-2013-3984?
Yes, IBM has released updates to address CVE-2013-3984 in the affected versions of Sametime.