Skip to content
OpenAdvisories
Medium · 6.3 CVE-2024-45651 EUVD-2024-54432GHSA-rvm5-9pv9-2rrc

IBM Sterling Connect:Direct Web Services session fixation

Published Apr 18, 2025 · Updated Sep 1, 2025 · Assigned by ibm

Vendor: IBM Product: Sterling Connect:Direct Web Services

Description

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0

does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system.

Affected products

VendorProductAffectedFixed
IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, 6.3.0 —

References