CVE-2018-1962

Published: Feb 4, 2019Modified: Nov 21, 2024

3.3

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.8 / Impact: 1.4

Source: NVD

Description

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658.

Affected (1)

Products: Ibm: Security Identity Manager

1 product

Security Identity Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ibm Security Identity Manager	From 7.0.1 to 7.0.1.10

Related CWEs

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (6)

http://www.ibm.com/support/docview.wss?uid=ibm10796380

Source: psirt@us.ibm.com

PatchVendor Advisory

http://www.securityfocus.com/bid/106854

Source: psirt@us.ibm.com

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/153658

Source: psirt@us.ibm.com

VDB EntryVendor Advisory

http://www.ibm.com/support/docview.wss?uid=ibm10796380

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/bid/106854

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/153658

Source: af854a3a-2127-422b-91ae-364da2661108

VDB EntryVendor Advisory

Timeline

No history available yet.