Skip to content
Fencer Vulns
low 3.7

CVE-2019-4688 json

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies.

published 2020-08-26 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-14295

cvss
3.7
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 171825.

Patch / fix

  • ibm guardium_data_encryption 4.0.0.3
  • ibm guardium_for_cloud_key_management 1.7.0

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 3.7 CVSS:3.0/A:N/UI:N/C:L/PR:N/I:N/AC:H/S:U/AV:N/E:U/RC:C/RL:O
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CNA 3.0 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

  • IBM Security Guardium Data Encryption

Classification

Weakness
  • CWE-565 Reliance on Cookies without Validation and Integrity Checking

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.