CVE-2019-4330 : What You Need to Know
Learn about CVE-2019-4330, a vulnerability in IBM Security Guardium Big Data Intelligence (SonarG) 4.0 that could expose cookies in plaintext over HTTP due to the absence of the secure attribute for cookies in HTTPS sessions.
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 lacks the secure attribute for cookies in HTTPS sessions, potentially exposing them in plaintext over HTTP.
Understanding CVE-2019-4330
This CVE involves a vulnerability in IBM Security Guardium Big Data Intelligence that could lead to the transmission of cookies in plaintext over an HTTP session due to the absence of the secure attribute for cookies in HTTPS sessions.
What is CVE-2019-4330?
The vulnerability in IBM Security Guardium Big Data Intelligence (SonarG) 4.0 allows user agents to send cookies in plaintext over an HTTP session because the secure attribute for cookies in HTTPS sessions is not set.
The Impact of CVE-2019-4330
The impact of this vulnerability is rated as low severity with a CVSS base score of 3.1. The confidentiality impact is low, and the exploit code maturity is unproven.
Technical Details of CVE-2019-4330
This section provides more technical insights into the vulnerability.
Vulnerability Description
The absence of the secure attribute for cookies in HTTPS sessions in IBM Security Guardium Big Data Intelligence (SonarG) 4.0 may result in the user agent transmitting those cookies in plaintext over an HTTP session.
Affected Systems and Versions
- Product: Security Guardium Big Data Intelligence
- Vendor: IBM
- Version: 4
Exploitation Mechanism
- Attack Complexity: High
- Attack Vector: Network
- User Interaction: Required
- Privileges Required: None
- Scope: Unchanged
Mitigation and Prevention
To address CVE-2019-4330, follow these mitigation strategies:
Immediate Steps to Take
- Ensure sensitive information is not transmitted over unsecured HTTP sessions.
- Implement secure cookie attributes for HTTPS sessions.
Long-Term Security Practices
- Regularly monitor and update security configurations.
- Conduct security assessments to identify and address vulnerabilities.
Patching and Updates
Apply the official fix provided by IBM to address the vulnerability in Security Guardium Big Data Intelligence (SonarG) 4.0.