CVE-2020-4316
First published: Mon Jul 13 2020(Updated: )
IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 177354.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Publishing Engine | =7.0 | |
| IBM Rational Publishing Engine | =6.0.6 | |
| IBM Rational Publishing Engine | =6.0.6.1 | |
| <=6.0.6.1 | ||
| <=6.0.6 | ||
| <=7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-4316?
CVE-2020-4316 is a vulnerability in IBM Publishing Engine that allows attackers to obtain cookie values by sending a link or planting a link in a site the user visits.
How does CVE-2020-4316 impact IBM Publishing Engine?
CVE-2020-4316 affects IBM Publishing Engine versions 6.0.6, 6.0.6.1, and 7.0.
What is the severity of CVE-2020-4316?
CVE-2020-4316 has a severity rating of 4.7, which is considered medium.
How can attackers exploit CVE-2020-4316?
Attackers can exploit CVE-2020-4316 by sending a http:// link to a user or by planting this link in a site the user goes to.
Are there any references for CVE-2020-4316?
Yes, you can find more information about CVE-2020-4316 at the following references: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/177354) and [IBM Support](https://www.ibm.com/support/pages/node/6249131).
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/author
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/ibm
- canonical/ibm publishing engine
- version/ibm publishing engine/7.0
- canonical/ibm rational publishing engine
- version/ibm rational publishing engine/6.0.6
- version/ibm rational publishing engine/6.0.6.1
- canonical/ibm pub
- version/ibm pub/7.0