CVE-2020-4173: Medium severity ibm initial release vulnerability
IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 174682.
Other sources
IBM Guardium Activity Insights does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-4173?
CVE-2020-4173 is a vulnerability in IBM Guardium Activity Insights 10.6 and 11.0 that does not set the secure attribute on authorization tokens or session cookies.
How does CVE-2020-4173 work?
Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to.
What is the severity of CVE-2020-4173?
The severity of CVE-2020-4173 is medium.
Which software versions are affected by CVE-2020-4173?
IBM Guardium Activity Insights 10.6 and 11.0 are affected by CVE-2020-4173.
How can I fix CVE-2020-4173?
To fix CVE-2020-4173, upgrade to a version of IBM Guardium Activity Insights that sets the secure attribute on authorization tokens and session cookies.