CVE-2018-1804

3.7 lowEPSS 0.9%

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 149703.

Severity

CVSS 3.0

3.7 low

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-384
Published: 2018-12-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ibm:security_access_manager

References

http://www.ibm.com/support/docview.wss?uid=ibm10787785
https://exchange.xforce.ibmcloud.com/vulnerabilities/149703
http://www.ibm.com/support/docview.wss?uid=ibm10787785
https://exchange.xforce.ibmcloud.com/vulnerabilities/149703

Check your stack JSON