CVE-2024-28771: medium-severity vulnerability in IBM Security Directory Integrator
IBM Security Directory Integrator information disclosure
Published · Updated
Follow this CVE+ Monitor Security Directory Integrator+ Monitor Security Verify Directory Integrator
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 0.2%
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Related CVEs — IBM Security Directory Integrator
In the same product, most dangerous first.
CVE-2022-33164HIGHIBM Security Directory Server path traversalEPSS 1.5%CVE-2024-28767MEDIUMIBM Security Directory Integrator command executionEPSS 0.7%CVE-2022-33162HIGHIBM Directory Server buffer overflowEPSS 0.4%CVE-2022-33167LOWIBM Security Directory Integrator information disclosureEPSS 0.4%CVE-2024-28765MEDIUMSecurity vulnerability was found in IBM Security Directory IntegratorEPSS 0.4%CVE-2022-32759MEDIUMIBM Security Directory Server information disclosureEPSS 0.4%