CVE-2023-33847
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk45th percentile — higher than 45% of all known CVEs
Summary
IBM TXSeries for Multiplatforms versions 8.1, 8.2, 9.1, and CICS TX Standard and Advanced versions 10.1 and 11.1 do not set the secure attribute on authorization tokens and session cookies. This may allow attackers to capture cookie values by sending an HTTP link to a user.
Risk Assessment
The lack of the secure attribute exposes the organization to the risk of session hijacking by attackers, potentially leading to unauthorized access to user data.
Recommendation
It is recommended to upgrade to the latest version of the software that sets the secure attribute for tokens and cookies to minimize the risk of interception.
Original NVD description (English source)
IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 257102.