CVE-2018-1948

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 153428.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
IBM	Security Identity Governance and Intelligence	5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; 5.2.3.2; 5.2.4; 5.2.4.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/153428VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10872142Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/153428VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10872142Patch, Vendor Advisory

Timeline

Published: Feb 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-194869.8Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cas CVE-2018-194877.5The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function throug CVE-2018-194889.8The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin CVE-2018-194894.7v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renami CVE-2018-19494.3IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized user CVE-2018-194907.8An issue was discovered in datafile.c in Gnuplot 5.2.5. This issue allows an attacker to conduct a heap-based buffer overflow with an arbitr CVE-2018-194917.8An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of CVE-2018-194927.8An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount o CVE-2018-194936.1An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. Ther CVE-2018-194944.3An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. Ther CVE-2018-194956.5An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is CVE-2018-194966.5An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.