Security Bulletin: IBM Security Verify Information Queue does not sufficiently safeguard session IDs from session fixation attacks (CVE-2021-20411)

Summary The web server in IBM Security Verify Information Queue ISIQ does not always update the session identifier when a new user logs in. This could allow a session fixation attack in which a previously used session identifier gets commandeered by an impersonator. As of v10.0.0, ISIQ now...

CVE-2021-20411

CVE-2021-20411 affects IBM Security Verify Information Queue (ISIQ) 1.0.6 and 1.0.7. The root cause is that the session identifier was not consistently updated on login, enabling potential session fixation and user impersonation. The IBM bulletin notes remediation by upgrading ISIQ images to tag ...