CVE-2023-33847
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
IBM TXSeries for Multiplatforms versions 8.1, 8.2, 9.1, and CICS TX Standard and Advanced versions 10.1 and 11.1 do not set the secure attribute on authorization tokens and session cookies. This may allow attackers to capture cookie values by sending an HTTP link to a user.
Risk Assessment
The lack of the secure attribute exposes the organization to the risk of session hijacking by attackers, potentially leading to unauthorized access to user data.
Recommendation
It is recommended to upgrade to the latest version of the software that sets the secure attribute for tokens and cookies to minimize the risk of interception.
Other vulnerabilities in IBM TXSeries for Multiplatforms, CICS TX Standard, CICS TX Advanced
See all- CVE-2023-33849Low
IBM TXSeries for Multiplatforms versions 8.1, 8.2, 9.1, and CICS TX Standard and Advanced versions 10.1 and 11.1 may transmit sensitive information in query parameters that could be intercepted using man-in-the-middle techniques.
- CVE-2023-33848Medium
IBM TXSeries for Multiplatforms versions 8.1, 8.2, 9.1, and CICS TX Standard and Advanced versions 10.1, 11.1 may allow a privileged user to obtain highly sensitive information by enabling debug mode.
Original NVD description (English source)
IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 257102.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS