IBM Security Directory Integrator and IBM Security Verify Directory Integrator Session Cookie Vulnerability

A vulnerability exists in IBM Security Directory Integrator version 7.2.0 and IBM Security Verify Directory Integrator version 10.0.0, where the secure attribute is not applied to authorization tokens or session cookies. This oversight allows attackers to intercept cookie values by sending a link to a user or embedding it in a site the user visits. The cookie would then be transmitted to the insecure link, enabling the attacker to snoop on the traffic and capture the cookie value.

Impact

Exploitation of this vulnerability could lead to the interception of session cookies, allowing attackers to hijack user sessions or access sensitive information contained in the cookies.

Remediation

Users are advised to update to IBM Security Directory Integrator version 7.2.0-ISS-SDI-FP0013 or IBM Security Verify Directory Integrator version 10.0.0.2. Instructions for downloading these updates are available on the IBM Support Fix Central website.