CVE-2024-39734: datacap — Fix

Description

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 296001.

Is your site exposed to CVE-2024-39734?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-565 CWE-565

CWE-614 CWE-614

Affected Products

Vendor	Product	Versions
ibm	datacap	All
ibm	datacap	All
ibm	datacap	All
ibm	datacap	All
ibm	datacap	All

References

Advisories & Patches

https://exchange.xforce.ibmcloud.com/vulnerabilities/296001 https://www.ibm.com/support/pages/node/7160185 https://exchange.xforce.ibmcloud.com/vulnerabilities/296001 https://www.ibm.com/support/pages/node/7160185

Frequently Asked Questions

What is CVE-2024-39734? +

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 296001. It has a CVSS v3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2024-39734? +

CVE-2024-39734 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-39734? +

CVE-2024-39734 affects products from ibm, specifically: datacap. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-39734? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-0257

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass …

CVE-2021-47706

COMMAX Biometric Access Control System 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access sensitive information and …

CVE-2025-2395 9.8

The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and …

CVE-2024-28288 9.8

Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An attacker …

CVE-2025-14440 9.8

The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. …

CVE-2024-0947 9.8

Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Manipulation, Accessing/Intercepting/Modifying …

CVE-2024-39734