CVE-2013-0529

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-06-21 · updated 2026-06-16
Weakness: CWE-264

Description

The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Affected products

IBM Sterling Connect:Direct Browser User Interface: 1.4.0.0, 1.4.0.2, 1.4.0.3, 1.4.0.6, 1.4.0.7, 1.4.0.10 (+2)

References

http://www-01.ibm.com/support/docview.wss?uid=swg1IC90478
http://www-01.ibm.com/support/docview.wss?uid=swg21640356
https://exchange.xforce.ibmcloud.com/vulnerabilities/82611
http://www-01.ibm.com/support/docview.wss?uid=swg1IC90478
http://www-01.ibm.com/support/docview.wss?uid=swg21640356
https://exchange.xforce.ibmcloud.com/vulnerabilities/82611

Get alerted when CVE-2013-0529 or the next vulnerability affects your stack