CVE-2021-29883: Medium severity ibm transformation extender advanced vulnerability
IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 207090.
Other sources
IBM Standards Processing Engine does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-29883?
CVE-2021-29883 is a vulnerability in IBM Standards Processing Engine that allows attackers to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to.
What is the severity of CVE-2021-29883?
The severity of CVE-2021-29883 is medium, with a severity value of 4.3.
Which software is affected by CVE-2021-29883?
IBM Transformation Extender Advanced versions 9.0.0.0 to 9.0.2.5 and versions 10.0.0 to 10.0.15 are affected by CVE-2021-29883.
How can attackers exploit CVE-2021-29883?
Attackers can exploit CVE-2021-29883 by sending a http:// link to a user or by planting this link in a site the user goes to, allowing them to obtain cookie values.
Are there any references for CVE-2021-29883?
Yes, you can refer to the following links for more information: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/207090) and [IBM Support](https://www.ibm.com/support/pages/node/6507077).