CVE-2017-1368: Medium severity ibm security identity governance and intelligence vulnerability

Published Aug 6, 2018

Updated

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 126861.

Affected Software

7 affected components

IBM Security Identity Governance and Intelligence=5.2

IBM Security Identity Governance and Intelligence=5.2.1

IBM Security Identity Governance and Intelligence=5.2.2

IBM Security Identity Governance and Intelligence=5.2.2.1

IBM Security Identity Governance and Intelligence=5.2.3

IBM Security Identity Governance and Intelligence=5.2.3.1

IBM Security Identity Governance and Intelligence=5.2.3.2

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg22016869

Event History

Aug 6, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2017-1368?

The severity of CVE-2017-1368 is medium.

How does CVE-2017-1368 affect IBM Security Identity Governance Virtual Appliance?

CVE-2017-1368 affects IBM Security Identity Governance Virtual Appliance versions 5.2 through 5.2.3.2.

What is the impact of CVE-2017-1368?

The impact of CVE-2017-1368 is that attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to.

How can attackers exploit CVE-2017-1368?

Attackers can exploit CVE-2017-1368 by sending a http:// link to a user or by planting this link in a site the user goes to.

What is the fix for CVE-2017-1368?

There is currently no fix available for CVE-2017-1368.