CVE-2019-4330
First published: Mon Oct 28 2019(Updated: )
IBM Security Guardium Big Data Intelligence (SonarG) does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Security Guardium Big Data Intelligence | =4.0 | |
| <=4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-4330?
CVE-2019-4330 has a moderate severity level due to the potential for exposing sensitive cookie data over non-secure HTTP connections.
How do I fix CVE-2019-4330?
To fix CVE-2019-4330, update IBM Security Guardium Big Data Intelligence to version 4.1 or later, which sets the secure attribute for cookies.
Which versions of IBM Security Guardium Big Data Intelligence are affected by CVE-2019-4330?
CVE-2019-4330 affects IBM Security Guardium Big Data Intelligence version 4.0 and earlier.
What could happen if CVE-2019-4330 is exploited?
If CVE-2019-4330 is exploited, cookies may be sent in plaintext over HTTP, potentially leading to session hijacking or data leakage.
Is there a known workaround for CVE-2019-4330?
There are no official workarounds for CVE-2019-4330; the recommended action is to upgrade to a secure version.
- collector/nvd-index
- agent/type
- agent/references
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/softwarecombine
- agent/description
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/ibm
- canonical/ibm security guardium big data intelligence
- version/ibm security guardium big data intelligence/4.0
- canonical/ibm security guardium big data intelligence (sonarg)
- version/ibm security guardium big data intelligence (sonarg)/4.0