IBM InfoSphere Information Server Insufficient Session Expiration Vulnerability

A vulnerability exists in IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6, due to insufficient session expiration. The application does not invalidate a user's session after privileges have been changed, potentially allowing an authenticated user to continue accessing sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information by allowing users to retain access rights after privileges have been modified.

Remediation

Users can upgrade to IBM InfoSphere Information Server versions 11.7.1.0, 11.7.1.6, or 11.7.1.6 Service Pack 2. Instructions for downloading these versions are available on the IBM Support website.