CVE-2016-5953

Description

IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL.

Affected products

• IBM Corporation / Sterling Order Management8.5 – 8.5
• IBM Corporation / Sterling Order Management8.0 – 8.0
• IBM Corporation / Sterling Order Management9.1 – 9.1
• IBM Corporation / Sterling Order Management9.2 – 9.2
• IBM Corporation / Sterling Order Management9.2.1 – 9.2.1
• IBM Corporation / Sterling Order Management9.3 – 9.3
• IBM Corporation / Sterling Order Management9.4 – 9.4
• IBM Corporation / Sterling Order Management9.5 – 9.5

References

• MISChttp://www.ibm.com/support/docview.wss?uid=swg21994521
• MISChttp://www.securityfocus.com/bid/95431