CVE-2024-39734
Ibm Datacap 9.1.5 … 9.1.9
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NSummary
CVE-2024-39734 is a medium-severity Reliance on Cookies without Validation and Integrity Checking (CWE-565) vulnerability in Ibm Datacap. Its CVSS base score is 4.3 (Medium).
Operationally, ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38214
Vulnerability Data
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by…
more
planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 296001.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.1
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Cookies commonly carry identity assertions; requiring their protection, conveyance, and verification directly eliminates the weakness.
Strong authentication mechanisms reduce reliance on unvalidated cookies for identity and access decisions.
Cryptographic integrity for data-in-transit directly mitigates tampering of cookies sent over the network.
Enforcing hardened configuration baselines includes requiring the Secure flag on sensitive cookies.
Secure SDLC practices explicitly require correct use of security attributes such as the cookie Secure flag.
Enforcing access policy and least privilege limits damage from cookie misuse but does not address cookie validation itself.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect cookie-validation flaws but does not itself implement the required controls.
Use of cryptography control mandates encryption in transit, which HTTPS provides, but does not specifically require the Secure cookie attribute.
Application security requirements can mandate cookie validation, integrity protection, and server-side session handling.
Secure coding practices directly eliminate reliance on unvalidated cookies by requiring proper integrity checks and server-side verification.
Secure authentication mechanisms can enforce server-side validation and integrity checks that prevent reliance on untrusted cookies.