Security Bulletin: IBM Security Information Queue does not invalidate sessions after logout (CVE-2020-4291)

Summary

IBM Security Information Queue (ISIQ) session identifiers are not properly invalidated upon user logout from ISIQ’s web UI. This create opportunities for an attacker to hijack a user session token. As of v1.0.6, ISIQ immediately invalidates the session token when a user logs out.

Vulnerability Details

CVEID:CVE-2020-4291
**DESCRIPTION:**IBM Security Information Queue (ISIQ) could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/176334 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Download and install the latest IBM Security Information Queue images (tagged at 1.0.6 or greater) from the Docker Hub repository. The instructions for accessing and deploying the images can be found on the ISIQ starter kit page: <https://www.ibm.com/support/pages/ibm-security-information-queue-starter-kit&gt;

Workarounds and Mitigations

None