CVE-2024-55897: IBM PowerHA SystemMirror for i information disclosure
IBM PowerHA SystemMirror for i 7.4 and 7.5
does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55897?
CVE-2024-55897 is classified as a medium severity vulnerability.
How do I fix CVE-2024-55897?
To fix CVE-2024-55897, ensure that the secure attribute is set on authorization tokens and session cookies.
What versions of PowerHA SystemMirror for i are affected by CVE-2024-55897?
CVE-2024-55897 affects IBM PowerHA SystemMirror for i versions 7.4 and 7.5.
What is the potential impact of CVE-2024-55897?
The potential impact of CVE-2024-55897 is that attackers may obtain sensitive cookie values through unprotected links.
Is there a workaround for CVE-2024-55897?
Currently, the best workaround for CVE-2024-55897 is to apply security best practices regarding cookie management and user awareness.