IBM Concert Software Session Hijacking Vulnerability (CVE-2024-43180)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: IBM Concert Software is vulnerable to session hijacking (CVE-2024-43180) 2. CVE ID: CVE-2024-43180 3. Description: IBM Concert does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to obtain the cookie values by sending a link to a user or by planting this link in a site the user visits. The cookie will be sent to the insecure link, and the attacker can then obtain the cookie value by snooping the traffic. 4. CVSS Base Score: 4.3 5. CVSS Temporal Score: See: for the current score. 6. Product: IBM Concert Software 7. Version: 1.0 8. Remediation: Download and follow the installation instructions to obtain IBM Concert Software 1.0.1 from the IBM Entitled Registry (ICR). 9. Notification: Subscribe to My Notifications to receive important product support alerts. 10. Related Links: - Complete CVSS v3 Guide - On-line Calculator v3 - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog 11. Disclaimer: The CVSS scores provided by IBM are “as is” and do not include any express or implied warranties, including but not limited to warranties of merchantability or fitness for a particular purpose. Customers should evaluate the impact of any actual or potential security vulnerabilities themselves. IBM periodically updates component records provided with its products. If IBM identifies a previously unrecognized package, it will address the related vulnerability regardless of the CVE date. Referenced components may be in IBM’s usage records, or IBM may have been aware of the vulnerability prior to that date. IBM is notifying customers of relevant vulnerabilities so they are aware of them. Affected products and versions refer only to products and versions supported by IBM and not beyond their support or warranty period. Therefore, referencing unsupported or extended support products or versions in a security bulletin does not constitute IBM’s determination that they are affected by the vulnerability. Referencing one or more unsupported versions in a security bulletin does not provide any fix for unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Concert Software Session Hijacking Vulnerability (CVE-2024-43180)

More from this source