CVE-2021-29883
First published: Fri Oct 08 2021(Updated: )
IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 207090.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Transformation Extender Advanced | >=9.0.0.0<9.0.2.5 | |
| IBM Transformation Extender Advanced | >=10.0.0<10.0.15 | |
| IBM Transformation Extender Advanced | <=9.0 | |
| IBM Transformation Extender Advanced | <=10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-29883?
CVE-2021-29883 is a vulnerability in IBM Standards Processing Engine that allows attackers to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to.
What is the severity of CVE-2021-29883?
The severity of CVE-2021-29883 is medium, with a severity value of 4.3.
Which software is affected by CVE-2021-29883?
IBM Transformation Extender Advanced versions 9.0.0.0 to 9.0.2.5 and versions 10.0.0 to 10.0.15 are affected by CVE-2021-29883.
How can attackers exploit CVE-2021-29883?
Attackers can exploit CVE-2021-29883 by sending a http:// link to a user or by planting this link in a site the user goes to, allowing them to obtain cookie values.
Are there any references for CVE-2021-29883?
Yes, you can refer to the following links for more information: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/207090) and [IBM Support](https://www.ibm.com/support/pages/node/6507077).
- collector/nvd-index
- agent/severity
- agent/author
- agent/references
- agent/event
- agent/type
- agent/tags
- agent/weakness
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/ibm
- canonical/ibm transformation extender advanced
- version/ibm transformation extender advanced/9.0.0.0
- version/ibm transformation extender advanced/10.0.0
- version/ibm transformation extender advanced/9.0
- version/ibm transformation extender advanced/10.0