IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
References
| Link | Resource |
|---|---|
| https://www.ibm.com/support/pages/node/7268028 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Apr 2026, 16:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ibm
Ibm maximo Application Suite |
|
| CWE | CWE-319 | |
| References | () https://www.ibm.com/support/pages/node/7268028 - Vendor Advisory | |
| CPE | cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:* |
01 Apr 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-01 21:17
Updated : 2026-04-07 16:28
NVD link : CVE-2026-4820
Mitre link : CVE-2026-4820
CVE.ORG link : CVE-2026-4820
JSON object : View
Products Affected
ibm
- maximo_application_suite