CVE-2021-29769: Medium severity ibm i2 analyze vulnerability
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 202769.
Other sources
IBM i2 Analyst's Notebook Premium does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29769?
CVE-2021-29769 is classified as a high-severity vulnerability due to its potential to expose sensitive authorization tokens and session cookies.
How do I fix CVE-2021-29769?
To address CVE-2021-29769, ensure that your installation of IBM i2 Analyst's Notebook is updated to a version that sets the secure attribute on authorization tokens and session cookies.
What versions of IBM i2 Analyze are affected by CVE-2021-29769?
CVE-2021-29769 impacts IBM i2 Analyze versions 4.3.0, 4.3.1, and 4.3.2.
What types of attacks can be executed due to CVE-2021-29769?
Attackers may exploit CVE-2021-29769 by sending unwanted links or embedding them in sites, enabling them to steal cookie values from users.
Is CVE-2021-29769 present in software outside of IBM i2 Analyze?
CVE-2021-29769 specifically affects IBM i2 Analyze and does not impact other software like Linux Kernel or Microsoft Windows.