Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-38977

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 212782.

Published

2021-11-15T16:15:09.850

Last Modified

2024-11-21T06:18:20.200

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-311
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application ibm security_guardium_key_lifecycle_manager 4.1.0 Yes
Application ibm security_guardium_key_lifecycle_manager 4.1.0.1 Yes
Application ibm security_guardium_key_lifecycle_manager 4.1.1 Yes
Application ibm security_key_lifecycle_manager ≤ 3.0.0.4 Yes
Application ibm security_key_lifecycle_manager ≤ 3.0.1.5 Yes
Application ibm security_key_lifecycle_manager ≤ 4.0.0.3 Yes
Application ibm security_key_lifecycle_manager 4.1.0 Yes
Application ibm security_key_lifecycle_manager 4.1.0.1 Yes
Application ibm security_key_lifecycle_manager 4.1.1 Yes
Operating System ibm aix - No
Operating System linux linux_kernel - No
Operating System microsoft windows - No
References