Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-1962

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658.

Published

2019-02-04T21:29:00.487

Last Modified

2024-11-21T04:00:40.013

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 4.0 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

3.9

Impact Score

2.9

Weaknesses

Type: Primary
CWE-384

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ibm	security_identity_manager	≤ 7.0.1.10	Yes

References

http://www.ibm.com/support/docview.wss?uid=ibm10796380 Patch, Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/106854 Third Party Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/153658 VDB Entry, Vendor Advisory ([email protected])
http://www.ibm.com/support/docview.wss?uid=ibm10796380 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/106854 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/153658 VDB Entry, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)