IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be…
ibm·CWE-565·Published 2020-10-20
IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 188518.
IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 188518.
IBM Spectrum Scale versiones 5.0.0 hasta 5.0.5.2 no establece el atributo seguro en tokens de autorización o cookies de sesión. Los atacantes pueden ser capaces de obtener los valores de las cookies al enviar un enlace http:// a un usuario o colocando este enlace en un sitio al que accede el usuario. La cookie se enviará al enlace no seguro y el atacante podrá obtener el valor de la cookie al rastrear el tráfico. IBM X-Force ID: 188518
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 2.0 | Primary | NVD | 4.3 | 8.6 | 2.9 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| 3.0 | Primary | cve.org | 4.3 | — | — | CVSS:3.0/C:L/A:N/AV:N/AC:L/S:U/I:N/PR:N/UI:R/RC:C/RL:O/E:U |
| 3.0 | Primary | cve.org | 4.3 | — | — | CVSS:3.0/C:L/A:N/AV:N/AC:L/S:U/I:N/PR:N/UI:R/RC:C/RL:O/E:U |
| 3.0 | Secondary | NVD | 4.3 | 2.8 | 1.4 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
| 3.1 | Primary | NVD | 4.3 | 2.8 | 1.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |