IBM Maximo Application Suite Sensitive Cookie Vulnerability Due to Missing Secure Attribute

A vulnerability exists in IBM Maximo Application Suite versions 9.1, 9.0, 8.11, and 8.10, where authorization tokens and session cookies are not configured with the secure attribute. This oversight allows attackers to intercept cookie values by sending a non-secure link to a user or embedding it in a site the user visits. The cookies would be transmitted over the insecure link, enabling the attacker to capture the cookie values by monitoring the traffic.

Impact

Exploitation of this vulnerability allows for the interception of session cookies, which could be used to hijack user sessions.

Remediation

Users can upgrade to IBM Maximo Application Suite versions 9.1.8, 9.0.19, 8.11.30, or 8.10.33 to address this vulnerability.