IBM Security Identity Governance/Intelligence up to 5.2.4.1 Token httponly session fixiation

Summaryinfo

A vulnerability was found in IBM Security Identity Governance and Intelligence up to 5.2.4.1 and classified as problematic. The impacted element is an unknown function of the component Token Handler. Such manipulation leads to session fixiation (httponly). This vulnerability is uniquely identified as CVE-2018-1948. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in IBM Security Identity Governance and Intelligence up to 5.2.4.1 (Access Management Software) and classified as problematic. Affected by this issue is an unknown code of the component Token Handler. The manipulation with an unknown input leads to a session fixiation vulnerability (httponly). Using CWE to declare the problem leads to CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. Impacted is confidentiality, integrity, and availability. CVE summarizes:

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 153428.

The bug was discovered 02/18/2019. The weakness was disclosed 02/21/2019 (Website). The advisory is shared for download at exchange.xforce.ibmcloud.com. This vulnerability is handled as CVE-2018-1948 since 12/13/2017. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 07/11/2023). It is expected to see the exploit prices for this product increasing in the near future.

The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-131068, VDB-131069, VDB-131070 and VDB-131071 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Access Management Software

Vendor

• IBM

Name

• Intelligence
• Security Identity Governance

Version

• 5.2.4.0
• 5.2.4.1

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion