CVE-2023-42016: IBM Sterling B2B Integrator information disclosure
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 265559.
Other sources
IBM Sterling B2B Integrator Standard Edition does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-42016?
CVE-2023-42016 is rated as a high severity vulnerability due to its potential for exploitation involving unauthorized access to session cookies.
How do I fix CVE-2023-42016?
To resolve CVE-2023-42016, ensure that the secure attribute is set on authorization tokens and session cookies in IBM Sterling B2B Integrator.
What versions of IBM Sterling B2B Integrator are affected by CVE-2023-42016?
CVE-2023-42016 affects IBM Sterling B2B Integrator versions 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3.
What is the main risk associated with CVE-2023-42016?
The main risk of CVE-2023-42016 is that attackers can potentially capture sensitive cookie values, leading to session hijacking.
Is user interaction required for exploiting CVE-2023-42016?
Yes, exploitation of CVE-2023-42016 typically requires user interaction, such as clicking a malicious link.