title: IBM CICS TX information disclosure
description:
IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 257102.
problem types: 614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
affected:
{
defaultStatus: unaffected
product: TXSeries for Multiplatforms
vendor: IBM
versions:
status: affected, version: 8.1, 8.2, 9.1
}
{
defaultStatus: unaffected
product: CICS TX Standard
vendor: IBM
versions:
status: affected, version: 11.1
}
{
defaultStatus: unaffected
product: CICS TX Advanced
vendor: IBM
versions:
status: affected, version: 10.1, 11.1
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL