CVE-2013-0539

2013-07-0313:54:31

CWE-255

[email protected]

web.nvd.nist.gov

ibm

sterling b2b integrator

session hijacking

vulnerability

nvd

cve-2013-0539

6.5 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

69.0%

JSON

An unspecified third-party component in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 uses short session ID values, which makes it easier for remote attackers to hijack sessions, and consequently obtain sensitive information, via a brute-force attack.

Affected configurations

NVD

Node

ibmsterling_b2b_integratorMatch5.1

ibmsterling_b2b_integratorMatch5.2

ibmsterling_file_gatewayMatch2.1

ibmsterling_file_gatewayMatch2.2

CPENameOperatorVersion
ibm:sterling_b2b_integratoribm sterling b2b integratoreq5.1
ibm:sterling_b2b_integratoribm sterling b2b integratoreq5.2
ibm:sterling_file_gatewayibm sterling file gatewayeq2.1
ibm:sterling_file_gatewayibm sterling file gatewayeq2.2

CPE	Name	Operator	Version
ibm:sterling_b2b_integrator	ibm sterling b2b integrator	eq	5.1
ibm:sterling_b2b_integrator	ibm sterling b2b integrator	eq	5.2
ibm:sterling_file_gateway	ibm sterling file gateway	eq	2.1
ibm:sterling_file_gateway	ibm sterling file gateway	eq	2.2