Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in IBM SmartCloud Analytics - CVE-2019-4214
Published: November 25, 2019
Vulnerability identifier: #VU22969
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-4214
CWE-ID:
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information on the target system.
The vulnerability exists due to the affected software does not set the secure attribute on authorization tokens or session cookies. A remote attacker can intercept the transmission and obtain information from the cookie in clear text.
Affected software
IBM SmartCloud Analytics
How to mitigate CVE-2019-4214
Install updates from vendor's website.
IBM SmartCloud Analytics - update to 1.3.6