Main Vulnerability Database Vulnerabilities #VU101630

Sensitive Cookie Without 'HttpOnly' Flag in Security Directory Integrator and Security Verify Directory Integrator - CVE-2022-33167

Published: December 11, 2024

Vulnerability identifier: #VU101630

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-33167

CWE-ID: CWE-1004

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the failure to set the HTTPOnly flag. A remote attacker can gain unauthorized access to sensitive information on the system from the cookie.

Affected software

Security Directory Integrator
Security Verify Directory Integrator
IBM Security Directory Suite

How to mitigate CVE-2022-33167

Install updates from vendor's website.

IBM Security Directory Suite - update to 8.0.1.22

External References

Related Security Bulletins