CVE-2024-28771

IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

• CWE-614

• https://www.ibm.com/support/pages/node/7161444Vendor Advisory

Published

Jan 27, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28764IBM WebSphere Automation 1.7.0 could allow an attacker with …7.8
• CVE-2024-28765IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory …5.3
• CVE-2024-28766IBM Security Directory Integrator 7.2.0 and IBM Security Ver…7.5
• CVE-2024-28767IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and…8.8
• CVE-2024-2877Vault Enterprise, when configured with performance standby n…5.5
• CVE-2024-28770IBM Security Directory Integrator 7.2.0 and IBM Security Ver…6.5
• CVE-2024-28772IBM Security Directory Integrator 7.2.0 and IBM Security Ver…5.4
• CVE-2024-28775IBM WebSphere Automation 1.7.0 is vulnerable to cross-site s…5.4
• CVE-2024-28776IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Cont…5.4
• CVE-2024-28777IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Cont…8.8
• CVE-2024-28778IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controll…6.5
• CVE-2024-2878An issue has been discovered in GitLab CE/EE affecting all v…7.5