Products
IBM Security Directory Integrator
- 7.2.0
IBM Security Verify Directory Integrator
- 10.0.0
Source
psirt@us.ibm.com
Tags
CVE-2022-33167 details
Published : July 30, 2024, 5:15 p.m.
Last Modified : July 30, 2024, 5:15 p.m.
Last Modified : July 30, 2024, 5:15 p.m.
Description
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 228587.
CVSS Score
| 1 | 2 | 3.7 | 4 | 5 | 6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-1004 | Sensitive Cookie Without 'HttpOnly' Flag | The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Base Score
3.7
Exploitability Score
2.2
Impact Score
1.4
Base Severity
LOW
Vector String : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
| URL | Source |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/228587 | psirt@us.ibm.com |
| https://www.ibm.com/support/pages/node/7161469 | psirt@us.ibm.com |
This website uses the NVD API, but is not approved or certified by it.