PT-2019-17083 · Ibm · Ibm Cloud Private
CVE-2019-4439
·
Published
2019-07-25
·
Updated
2022-12-03
CVSS v3.1
5.3
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
IBM Cloud Private versions 3.1.0 through 3.1.2
Description
The issue allows a local user to impersonate another user on the system because it does not invalidate the session after logout.
Recommendations
For versions 3.1.0 through 3.1.2, consider implementing a custom session invalidation mechanism after user logout as a temporary workaround until a patch is available.
Fix
Session Fixation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ibm Cloud Private