CVE-2024-43180: IBM Concert information disclosure
IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Other sources
IBM Concert does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43180?
The severity of CVE-2024-43180 is considered to be moderate due to the risk of unauthorized access to session cookies.
How do I fix CVE-2024-43180?
To fix CVE-2024-43180, update to the latest version of IBM Concert Software as per the vendor's instructions.
Who is affected by CVE-2024-43180?
CVE-2024-43180 affects users of IBM Concert Software version 1.0.
What are the potential consequences of CVE-2024-43180?
The potential consequences of CVE-2024-43180 include attackers being able to hijack user sessions by intercepting insecure cookie values.
What products are linked to CVE-2024-43180?
CVE-2024-43180 specifically impacts IBM Concert Software version 1.0.