CVE-2022-38386
IBM Cloud Pak for Security information disclosure
In short
IBM Cloud Pak for Security and QRadar Suite fail to properly protect sensitive cookies by not setting the SameSite attribute, allowing attackers to intercept and steal this information through man-in-the-middle attacks.
Technical detail
The vulnerability stems from missing SameSite cookie attribute configuration in IBM Cloud Pak for Security (versions 1.10.0.0–1.10.11.0) and IBM QRadar Suite (versions 1.10.12.0–1.10.19.0). An attacker positioned on the network path between client and server can exploit this to capture sensitive session cookies and gain unauthorized access.
Summary generated and translated by AI from the official description.
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite for Software 1.10.12.0 through 1.10.19.0 does not set the SameSite attribute for sensitive cookies which could allow an attacker to obtain sensitive information using man-in-the-middle techniques. IBM X-Force ID: 233778.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →