CVE-2016-0351

CVE-2016-0351 affects IBM Security Identity Manager Virtual Appliance versions 7.0.x prior to 7.0.1.3-ISS-SIM-IF0001. The vulnerability stems from the virtual appliance failing to set the secure flag for session cookies during HTTPS sessions. This omission allows remote attackers to more easily capture session cookies if they can intercept traffic within an HTTP session. The CVSSv3 score of 3.7 (LOW) indicates a network-based attack with high attack complexity, requiring no privileges or user interaction, and resulting in low confidentiality impact without affecting integrity or availability. While the potential impact is limited to session cookie capture, it could lead to unauthorized access if successfully exploited. There is no evidence of active exploitation, and no public exploit code is available via Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting low public awareness and attention to this vulnerability.