Security Bulletin: IBM Transformation Extender Advanced and IBM Standards Processing Engine are susceptible to a vulnerability in 10x (CVE-2017-1152)

Summary

IBM 10x framework does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system.

Vulnerability Details

CVEID: CVE-2017-1152**
DESCRIPTION:** IBM Sterling Global Integration On-Demand Environment does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/122293 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM Standards Processing Engine version 8.5 (common component 2.0.x)

IBM Transformation Extender Advanced version 9.0

Remediation/Fixes

Product

| VRMF| Remediation/First Fix
—|—|—
IBM Standards Processing Engine| 8.5.1| 8.5.1.2 (2.0.1.2 for common component) available on Fix Central
IBM Transformation Extender Advanced| 9.0.0| 9.0.0.6

Workarounds and Mitigations

None