CVE-2020-4749: Medium severity IBM Spectrum Scale vulnerability
IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 188518.
Other sources
IBM Spectrum Scale does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2020-4749.
What is the severity level of CVE-2020-4749?
The severity level of CVE-2020-4749 is medium.
What software versions are affected by CVE-2020-4749?
IBM Spectrum Scale versions 5.0.0 through 5.0.5.2 are affected by CVE-2020-4749.
How can attackers exploit CVE-2020-4749?
Attackers can exploit CVE-2020-4749 by sending a http:// link to a user or by planting this link in a site the user goes to.
Are there any references available for CVE-2020-4749?
Yes, you can find references for CVE-2020-4749 at the following links: [Reference 1](https://exchange.xforce.ibmcloud.com/vulnerabilities/188518), [Reference 2](https://www.ibm.com/support/pages/node/6349449).