Vulnerability in IBM Sterling Connect Direct User Interface

CVE-2013-0529

The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

EPSS: 0.014 (68.8th percentile) — read the EPSS interpretation.

Affected products

Ibm Sterling_connect_direct_user_interface — versions 1.4.0.0, 1.4.0.2, 1.4.0.3
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

psirt@us.ibm.com (x_refsource_CONFIRM)
psirt@us.ibm.com (vendor-advisory, x_refsource_AIXAPAR)
psirt@us.ibm.com (vdb-entry, x_refsource_XF)