CVE-2018-1962

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed

Medium · published February 4, 2019

CVSS v3.0
4.0
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658.

The record
Technical detail
CVSS v3.0
4.0 · MEDIUM
Vector
CVSS:3.0/A:N/AC:L/AV:L/C:L/I:N/PR:N/S:U/UI:N/E:U/RC:C/RL:O
CVSS v4.0
Not supplied
EPSS
0.00362 · 28.9th percentile
Published
2019-02-04T21:00Z
EPSS history
Timeline
  • 04 FEB 21:00Z
    IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed
    cvelistv5