IBM Sterling Partner Engagement Manager Expired Access Token Information Disclosure Vulnerability

A vulnerability exists in IBM Sterling Partner Engagement Manager versions 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2, allowing an attacker to access sensitive user information using an expired access token. This issue is rooted in the improper handling of access token expiration, which could be exploited to retrieve confidential data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive user information.

Remediation

Users are advised to upgrade to IBM Sterling Partner Engagement Manager version 6.2.3.6 or 6.2.4.3, depending on their current version. Instructions for downloading the patched versions are available on the IBM Support Fix Central website.