CVE-2024-43173: low-severity vulnerability in IBM Concert
IBM Concert information disclosure
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.7epss 0.2%
In short
IBM Concert versions 1.0.0 and 1.0.1 don't properly protect cookies, allowing attackers to steal user session data through cross-site requests. This puts user accounts at risk of unauthorized access.
Technical detail
The application fails to set the SameSite attribute on cookies, enabling CSRF-based cookie theft attacks. An attacker can craft malicious cross-site requests to harvest session cookies from authenticated users, potentially leading to session hijacking and information disclosure.
Summary generated and translated by AI from the official description.
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
IBM · ConcertRelated CVEs — IBM Concert
In the same product, most dangerous first.
CVE-2026-6721CRITICALMultiple Vulnerabilities in IBM Concert SoftwareEPSS 1.2%CVE-2026-3627CRITICALMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.5%CVE-2026-17465MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.5%CVE-2025-12767MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.5%CVE-2026-6925MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.5%CVE-2026-6928CRITICALMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.5%