4.7
CVE-2020-4291
- EPSS 0.15%
- Veröffentlicht 08.04.2020 14:15:13
- Zuletzt bearbeitet 21.11.2024 05:32:32
- Quelle psirt@us.ibm.com
- Teams Watchlist Login
- Unerledigt Login
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI. IBM X-Force ID: 176334.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Security Information Queue Version1.0.0
Ibm ≫ Security Information Queue Version1.0.1
Ibm ≫ Security Information Queue Version1.0.2
Ibm ≫ Security Information Queue Version1.0.3
Ibm ≫ Security Information Queue Version1.0.4
Ibm ≫ Security Information Queue Version1.0.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.15% | 0.318 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:P/I:N/A:N
|
| psirt@us.ibm.com | 4.7 | 2.8 | 1.4 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
|
CWE-384 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.