IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0
does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system.
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Sterling_connect_direct_web_services | Ibm | 6.1.0 (including) | 6.1.0.28 (excluding) |
| Sterling_connect_direct_web_services | Ibm | 6.2.0 (including) | 6.2.0.27 (excluding) |
| Sterling_connect_direct_web_services | Ibm | 6.3.0 (including) | 6.3.0.13 (excluding) |