IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time, therefore users are presented with information for Spectrum Control Application. IBM X-Force ID: 157064.
Weakness
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Spectrum_control | Ibm | 5.2.8 (including) | 5.2.17.2 (including) |
| Spectrum_control | Ibm | 5.3.0 (including) | 5.3.1 (including) |
| Tivoli_storage_productivity_center | Ibm | 5.2.0 (including) | 5.2.7.1 (including) |