IBM Rational Build Forge Session ID Information Disclosure Vulnerability

Bugtraq ID:	47712
Class:	Input Validation Error
CVE:	CVE-2011-1839
Remote:	Yes
Local:	No
Published:	Apr 08 2011 12:00AM
Updated:	Apr 08 2011 12:00AM
Credit:	IBM
Vulnerable:	IBM Rational Build Forge 7.0.2 IBM Rational Build Forge 7.1.0
Not Vulnerable:

IBM Rational Build Forge Session ID Information Disclosure Vulnerability

IBM Rational Build Forge is prone to an information-disclosure vulnerability that may allow attackers to harvest session IDs.

Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks.

Rational Build Forge 7.1.0 is vulnerable; other versions may also be affected.

IBM Rational Build Forge Session ID Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Rational Build Forge Session ID Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for details.

IBM Rational Build Forge Session ID Information Disclosure Vulnerability

References:

• IBM Rational Build Forge Homepage (IBM)
  
• PM29655: Vulnerability issue: session id can be stolen due to http's get method (IBM)