CVE-2013-0529

IBM Sterling Connect:Direct <1.4.0.11 & 1.5-1.5.0.1 - Info Disclosure

Title source: llm
STIX 2.1

Description

The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

References (3)

Core 3
Core References
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21640356
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IC90478
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/82611

Scores

EPSS 0.0135
EPSS Percentile 68.7%

Details

CWE
CWE-264
Status published
Products (8)
ibm/sterling_connect_direct_user_interface 1.4.0.0
ibm/sterling_connect_direct_user_interface 1.4.0.2
ibm/sterling_connect_direct_user_interface 1.4.0.3
ibm/sterling_connect_direct_user_interface 1.4.0.6
ibm/sterling_connect_direct_user_interface 1.4.0.7
ibm/sterling_connect_direct_user_interface 1.4.0.10
ibm/sterling_connect_direct_user_interface 1.5.0.0
ibm/sterling_connect_direct_user_interface 1.5.0.1
Published Jun 21, 2013
Tracked Since Feb 18, 2026