Vulnerability-Lookup

CVE-2026-4820 (GCVE-0-2026-4820)

Vulnerability from cvelistv5 – Published: 2026-04-01 20:54 – Updated: 2026-04-02 15:51

Title

IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flag

Summary

IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Assigner

ibm

References

URL

Tags

https://www.ibm.com/support/pages/node/7268028

vendor-advisorypatch

Impacted products

	Vendor	Product	Version
	IBM	Maximo Application Suite	Affected: 9.1.0 , ≤ 10.6.5.0 (semver) Affected: 9.0 (semver) Affected: 8.11.0 (semver) Affected: 8.10 (semver) cpe:2.3:a:ibm:maximo_application_suite:9.1:::::::* cpe:2.3:a:ibm:maximo_application_suite:9.1.0:::::::* cpe:2.3:a:ibm:maximo_application_suite:9.0:::::::* cpe:2.3:a:ibm:maximo_application_suite:9.0.0:::::::* cpe:2.3:a:ibm:maximo_application_suite:8.11:::::::* cpe:2.3:a:ibm:maximo_application_suite:8.11.0:::::::* cpe:2.3:a:ibm:maximo_application_suite:8.10:::::::* cpe:2.3:a:ibm:maximo_application_suite:8.10.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4820",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-02T15:51:25.221671Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-02T15:51:44.073Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*"
          ],
          "product": "Maximo Application Suite",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "10.6.5.0",
              "status": "affected",
              "version": "9.1.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.11.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.10",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.\u003c/p\u003e"
            }
          ],
          "value": "IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-614",
              "description": "CWE-614 Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T20:54:09.417Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7268028"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eRemediated Product(s)\u003c/td\u003e\u003ctd\u003eVersion(s)\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.1.8\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.0.19\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.11.30\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.10.33\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Remediated Product(s)Version(s)IBM Maximo Application Suite9.1.8IBM Maximo Application Suite9.0.19IBM Maximo Application Suite8.11.30IBM Maximo Application Suite8.10.33"
        }
      ],
      "title": "IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_\u003cworkspace_name\u003e was not set with secure flag",
      "x_generator": {
        "engine": "ibm-cvegen"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-4820",
    "datePublished": "2026-04-01T20:54:09.417Z",
    "dateReserved": "2026-03-25T13:48:17.676Z",
    "dateUpdated": "2026-04-02T15:51:44.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-4820\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2026-04-01T21:17:02.827\",\"lastModified\":\"2026-04-07T16:28:01.440\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-614\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-319\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.10\",\"versionEndExcluding\":\"8.10.33\",\"matchCriteriaId\":\"31F32ACF-51E7-490F-BC1B-431F002FCA49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.11\",\"versionEndExcluding\":\"8.11.30\",\"matchCriteriaId\":\"0157833D-F63E-4B9B-B51C-D9FFD7AD0167\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0\",\"versionEndExcluding\":\"9.0.19\",\"matchCriteriaId\":\"F7367CAC-E918-46BA-99D2-23397732FD90\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.1\",\"versionEndExcluding\":\"9.1.8\",\"matchCriteriaId\":\"F7858D3F-F186-489A-A651-F4BFAE27A72C\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7268028\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-4820\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-02T15:51:25.221671Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-02T15:51:31.995Z\"}}], \"cna\": {\"title\": \"IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_\u003cworkspace_name\u003e was not set with secure flag\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"Maximo Application Suite\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"10.6.5.0\"}, {\"status\": \"affected\", \"version\": \"9.0\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.11.0\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.10\", \"versionType\": \"semver\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Remediated Product(s)Version(s)IBM Maximo Application Suite9.1.8IBM Maximo Application Suite9.0.19IBM Maximo Application Suite8.11.30IBM Maximo Application Suite8.10.33\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eRemediated Product(s)\u003c/td\u003e\u003ctd\u003eVersion(s)\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.1.8\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.0.19\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.11.30\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.10.33\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7268028\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"x_generator\": {\"engine\": \"ibm-cvegen\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-614\", \"description\": \"CWE-614 Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-04-01T20:54:09.417Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-4820\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-02T15:51:44.073Z\", \"dateReserved\": \"2026-03-25T13:48:17.676Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-04-01T20:54:09.417Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-7CVP-JXJH-QVVF

Vulnerability from github – Published: 2026-04-01 21:30 – Updated: 2026-04-01 21:30

Details

Severity ?

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-4820"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-319",
      "CWE-614"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-01T21:17:02Z",
    "severity": "MODERATE"
  },
  "details": "IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.",
  "id": "GHSA-7cvp-jxjh-qvvf",
  "modified": "2026-04-01T21:30:32Z",
  "published": "2026-04-01T21:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4820"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7268028"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

VA-26-097-02

Vulnerability from csaf_cisa - Published: 2026-04-07 20:51 - Updated: 2026-04-07 20:51

Summary

IBM Maximo Application Suite Sensitive Tokens without 'Secure' Attribute

Notes

Legal Notice: All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).

Countries and Areas Deployed: Worldwide

Critical Infrastructure Sectors: Information Technology

Risk Evaluation: IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. An unauthenticated attacker can steal cookies by directing users to a malicious http:// link and snooping user traffic.

Recommended Practices: Fixed in IBM Maximo Application Suite versions 9.1.8, 9.0.19, 8.11.30, and 8.10.33.

Company Headquarters Location: United States

CVE-2026-4820

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Vendor Fix Fixed in 9.1.8, 9.0.19, 8.11.30, and 8.10.33. https://www.ibm.com/support/pages/node/7268028/

References

URL

Category

	https://raw.githubusercontent.com/cisagov/CSAF/de…	self
	https://www.ibm.com/support/pages/node/7268028	external
	https://www.cve.org/CVERecord?id=CVE-2026-4820	external
	https://raw.githubusercontent.com/cisagov/CSAF/de…	external

Acknowledgments

Sandia National Laboratories Zane Parker

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries and Areas Deployed"
      },
      {
        "category": "other",
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors"
      },
      {
        "category": "summary",
        "text": "IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. An unauthenticated attacker can steal cookies by directing users to a malicious http:// link and snooping user traffic. ",
        "title": "Risk Evaluation"
      },
      {
        "category": "general",
        "text": "Fixed in IBM Maximo Application Suite versions 9.1.8, 9.0.19, 8.11.30, and 8.10.33.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company Headquarters Location"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerability Advisory VA-26-097-02 CSAF",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-097-02.json"
      }
    ],
    "title": "IBM Maximo Application Suite Sensitive Tokens without \u0027Secure\u0027 Attribute",
    "tracking": {
      "current_release_date": "2026-04-07T20:51:13Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.13.0+build.51"
        }
      },
      "id": "VA-26-097-02",
      "initial_release_date": "2026-04-07T20:51:13Z",
      "revision_history": [
        {
          "date": "2026-04-07T20:51:13Z",
          "number": "1.0.0",
          "summary": "Initial publication"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9.1.0",
                "product": {
                  "name": "IBM Maximo Application Suite 9.1.0",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "9.0",
                "product": {
                  "name": "IBM Maximo Application Suite 9.0",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version",
                "name": "8.11.0",
                "product": {
                  "name": "IBM Maximo Application Suite 8.11.0",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "8.10",
                "product": {
                  "name": "IBM Maximo Application Suite 8.10",
                  "product_id": "CSAFPID-0004"
                }
              },
              {
                "category": "product_version",
                "name": "9.1.8",
                "product": {
                  "name": "IBM Maximo Application Suite 9.1.8",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.19",
                "product": {
                  "name": "IBM Maximo Application Suite 9.0.19",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version",
                "name": "8.11.30",
                "product": {
                  "name": "IBM Maximo Application Suite 8.11.30",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version",
                "name": "8.10.33",
                "product": {
                  "name": "IBM Maximo Application Suite 8.10.33",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "Maximo Application Suite"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Zane Parker"
          ],
          "organization": "Sandia National Laboratories"
        }
      ],
      "cve": "CVE-2026-4820",
      "cwe": {
        "id": "CWE-614",
        "name": "Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute"
      },
      "notes": [
        {
          "category": "summary",
          "text": "IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the \u0027secure\u0027 attribute on authorization tokens or session cookies. An unauthenticated attacker can steal cookies by directing users to a malicious http:// link and snooping user traffic. Fixed in 9.1.8, 9.0.19, 8.11.30, and 8.10.33.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:P/2026-04-06T18:03:38Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.ibm.com",
          "url": "https://www.ibm.com/support/pages/node/7268028"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4820"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-097-02.json"
        }
      ],
      "release_date": "2026-04-01T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-30T00:00:00Z",
          "details": "Fixed in 9.1.8, 9.0.19, 8.11.30, and 8.10.33.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.ibm.com/support/pages/node/7268028/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-30T00:00:00Z",
          "details": "Fixed in 9.1.8, 9.0.19, 8.11.30, and 8.10.33.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://www.ibm.com/support/pages/node/7268028/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-30T00:00:00Z",
          "details": "Fixed in 9.1.8, 9.0.19, 8.11.30, and 8.10.33.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.ibm.com/support/pages/node/7268028/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-30T00:00:00Z",
          "details": "Fixed in 9.1.8, 9.0.19, 8.11.30, and 8.10.33.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.ibm.com/support/pages/node/7268028/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-30T00:00:00Z",
          "details": "Fixed in 9.1.8, 9.0.19, 8.11.30, and 8.10.33.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.ibm.com/support/pages/node/7268028/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-30T00:00:00Z",
          "details": "Fixed in 9.1.8, 9.0.19, 8.11.30, and 8.10.33.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://www.ibm.com/support/pages/node/7268028/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-30T00:00:00Z",
          "details": "Fixed in 9.1.8, 9.0.19, 8.11.30, and 8.10.33.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://www.ibm.com/support/pages/node/7268028/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-30T00:00:00Z",
          "details": "Fixed in 9.1.8, 9.0.19, 8.11.30, and 8.10.33.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://www.ibm.com/support/pages/node/7268028/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        }
      ],
      "title": "IBM Maximo Application Suite Sensitive Tokens without \u0027Secure\u0027 Attribute"
    }
  ]
}

FKIE_CVE-2026-4820

Vulnerability from fkie_nvd - Published: 2026-04-01 21:17 - Updated: 2026-04-07 16:28

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7268028	Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	maximo_application_suite	*
ibm	maximo_application_suite	*
ibm	maximo_application_suite	*
ibm	maximo_application_suite	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "31F32ACF-51E7-490F-BC1B-431F002FCA49",
              "versionEndExcluding": "8.10.33",
              "versionStartIncluding": "8.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0157833D-F63E-4B9B-B51C-D9FFD7AD0167",
              "versionEndExcluding": "8.11.30",
              "versionStartIncluding": "8.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7367CAC-E918-46BA-99D2-23397732FD90",
              "versionEndExcluding": "9.0.19",
              "versionStartIncluding": "9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7858D3F-F186-489A-A651-F4BFAE27A72C",
              "versionEndExcluding": "9.1.8",
              "versionStartIncluding": "9.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic."
    }
  ],
  "id": "CVE-2026-4820",
  "lastModified": "2026-04-07T16:28:01.440",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "psirt@us.ibm.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-04-01T21:17:02.827",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7268028"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-614"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-4820 (GCVE-0-2026-4820)

GHSA-7CVP-JXJH-QVVF

VA-26-097-02

FKIE_CVE-2026-4820

Tags

Sightings

Nomenclature