CVE-2017-1368
First published: Mon Aug 06 2018(Updated: )
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 126861.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Security Identity Governance and Intelligence | =5.2 | |
| IBM Security Identity Governance and Intelligence | =5.2.1 | |
| IBM Security Identity Governance and Intelligence | =5.2.2 | |
| IBM Security Identity Governance and Intelligence | =5.2.2.1 | |
| IBM Security Identity Governance and Intelligence | =5.2.3 | |
| IBM Security Identity Governance and Intelligence | =5.2.3.1 | |
| IBM Security Identity Governance and Intelligence | =5.2.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-1368?
The severity of CVE-2017-1368 is medium.
How does CVE-2017-1368 affect IBM Security Identity Governance Virtual Appliance?
CVE-2017-1368 affects IBM Security Identity Governance Virtual Appliance versions 5.2 through 5.2.3.2.
What is the impact of CVE-2017-1368?
The impact of CVE-2017-1368 is that attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to.
How can attackers exploit CVE-2017-1368?
Attackers can exploit CVE-2017-1368 by sending a http:// link to a user or by planting this link in a site the user goes to.
What is the fix for CVE-2017-1368?
There is currently no fix available for CVE-2017-1368.
- collector/nvd-index
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/ibm
- canonical/ibm security identity governance and intelligence
- version/ibm security identity governance and intelligence/5.2
- version/ibm security identity governance and intelligence/5.2.1
- version/ibm security identity governance and intelligence/5.2.2
- version/ibm security identity governance and intelligence/5.2.2.1
- version/ibm security identity governance and intelligence/5.2.3
- version/ibm security identity governance and intelligence/5.2.3.1
- version/ibm security identity governance and intelligence/5.2.3.2