CVE-2017-1732: Infoleak
IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 134913.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1732?
The severity of CVE-2017-1732 is considered moderate due to its potential to expose sensitive session cookies.
How do I fix CVE-2017-1732?
To fix CVE-2017-1732, ensure that your IBM Security Access Manager for Enterprise Single Sign-On is configured to set the secure attribute on authorization tokens and session cookies.
What consequences does CVE-2017-1732 pose?
CVE-2017-1732 may allow attackers to hijack user sessions by stealing insecure cookies through crafted links.
Which versions are affected by CVE-2017-1732?
CVE-2017-1732 affects version 8.2.2 of IBM Security Access Manager for Enterprise Single Sign-On.
What is CVE-2017-1732?
CVE-2017-1732 is a vulnerability in IBM Security Access Manager for Enterprise Single Sign-On that fails to secure session cookies, leading to potential session hijacking.