IBM Jazz for Service Management Sensitive Cookie Vulnerability Allowing Cookie Theft

A vulnerability exists in IBM Jazz for Service Management versions 1.1.3.0 through 1.1.3.24, where the secure attribute is not applied to authorization tokens or session cookies. This oversight allows attackers to intercept cookie values by sending a non-secure link to a user or embedding it in a site the user visits. The cookies would then be transmitted over the insecure link, enabling the attacker to snoop on the traffic and capture the cookie values.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user sessions or sensitive information contained in the cookies.

Remediation

Users can upgrade to IBM Jazz for Service Management version 1.1.3.25 to address this vulnerability.