CVE-2019-4616 Information disclosure in Cloud Automation Manager

Medium 4.3 Published 5 Feb 2020 Updated 16 Sep 2024

Attackers can steal session cookies via insecure HTTP links, potentially leading to account takeover in IBM Cloud Automation Manager.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-4616?

CVE-2019-4616 is a medium-severity vulnerability in IBM Cloud Automation Manager, published on 5 Feb 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 168644.

Weakness: CWE-311

Which versions are affected by CVE-2019-4616?

It affects 1 product.

Products include Ibm Cloud Automation Manager.

How do I fix CVE-2019-4616?

No fix has been published for CVE-2019-4616 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-4616 being exploited?

There is no known exploitation of CVE-2019-4616 in the wild and no public exploit code.

Sources

Also known as GHSA-j44p-4jq2-r649.