CVE-2022-33167: ibm security_directory_integrator Sensitive Cookie Without 'HttpOnly' Flag
Vulnerability summary
CVE-2022-33167 is a high (CVSS 7.5) Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ibm security_directory_integrator. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.5% of scored vulnerabilities.
Timeline
- 30-07-2024PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 228587.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
0.00 pp
From 0.43% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1004Sensitive Cookie Without 'HttpOnly' FlagThe product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Ibm2 products
1 vendor · 2 products
References
2 links- www.ibm.com/support/pages/node/7161469Vendor Advisory