CVE-2023-42016 MEDIUM

CVE-2023-42016: IBM Sterling B2B Integrator information disclosure

Vendor Ibm
Product Sterling B2B Integrator
Weakness CWE-614 · Cookie without Secure flag
Published February 9, 2024
Last update August 22, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 265559.

Key dates

02Disclosure timeline

February 9, 2024 CVE published
August 22, 2024 Record updated