Session fixation

2022-11-2219:15:00

PRIOn knowledge base

www.prio-n.com

session fixation

ibm datapower gateway

password change

impersonation

x-force id

nvd

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.9%

JSON

IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235527.

CPENameOperatorVersion
datapower_gatewayge10.0.1.0
datapower_gatewayle10.0.1.9
datapower_gatewayge10.0.3.0
datapower_gatewayle10.0.4.0
datapower_gatewayge2018.4.1.0
datapower_gatewayle2018.4.1.22
datapower_gatewayge10.5.0.0
datapower_gatewayle10.5.0.2

Name	Operator	Version
datapower_gateway	ge	10.0.1.0
datapower_gateway	le	10.0.1.9
datapower_gateway	ge	10.0.3.0
datapower_gateway	le	10.0.4.0
datapower_gateway	ge	2018.4.1.0
datapower_gateway	le	2018.4.1.22
datapower_gateway	ge	10.5.0.0
datapower_gateway	le	10.5.0.2