Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

IBM Rational Build Forge 7.1.0 may expose session IDs

CVE-2011-1839 · published 15 years ago
Summary

The web login for IBM Rational Build Forge 7.1.0 redirects users using a GET request that includes the session identifier. Because the identifier travels in the URL, it can be captured from server logs, referral information, or a user's browser history, allowing attackers to hijack a session. Update to a version that uses POST for the redirect or apply the vendor's configuration guidance to protect the session data.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm rational_build_forge 7.1.0
cpe:2.3:a:ibm:rational_build_forge:7.1.0:*:*:*:*:*:*:*
Original advisory text
IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session...
IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published28 Apr 2011
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2011-1839 · NVD
Track software like this
Free during beta