CVE-2023-42016: IBM Sterling B2B Integrator information disclosure
First published: Wed Feb 07 2024(Updated: )
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 265559.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM B2B Sterling Integrator | <=6.0.0.0 - 6.0.3.8 | |
| IBM B2B Sterling Integrator | <=6.1.0.0 - 6.1.2.3 | |
| IBM B2B Sterling Integrator | >=6.0.0.0<=6.0.3.8 | |
| IBM B2B Sterling Integrator | >=6.1.0.0<=6.1.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-42016?
CVE-2023-42016 is rated as a high severity vulnerability due to its potential for exploitation involving unauthorized access to session cookies.
How do I fix CVE-2023-42016?
To resolve CVE-2023-42016, ensure that the secure attribute is set on authorization tokens and session cookies in IBM Sterling B2B Integrator.
What versions of IBM Sterling B2B Integrator are affected by CVE-2023-42016?
CVE-2023-42016 affects IBM Sterling B2B Integrator versions 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3.
What is the main risk associated with CVE-2023-42016?
The main risk of CVE-2023-42016 is that attackers can potentially capture sensitive cookie values, leading to session hijacking.
Is user interaction required for exploiting CVE-2023-42016?
Yes, exploitation of CVE-2023-42016 typically requires user interaction, such as clicking a malicious link.
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- agent/remedy
- agent/weakness
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/ibm
- canonical/ibm b2b sterling integrator
- version/ibm b2b sterling integrator/6.0.0.0 - 6.0.3.8
- version/ibm b2b sterling integrator/6.1.0.0 - 6.1.2.3
- version/ibm b2b sterling integrator/6.0.0.0
- version/ibm b2b sterling integrator/6.0.3.8
- version/ibm b2b sterling integrator/6.1.0.0
- version/ibm b2b sterling integrator/6.1.2.3