CVE-2024-40683 is an insufficient session expiration vulnerability in IBM Operations Analytics - Log Analysis affecting versions 1.3.5.0 through 1.3.8.4. The product does not invalidate existing sessions after a user changes their password, which could allow an authenticated user to continue using a session tied to previous credentials and potentially impersonate another user. This issue is categorized under CWE-613. No official remediation or patch information is currently provided, and no known exploits are reported in the wild.

An authenticated user could exploit this vulnerability to impersonate another user by leveraging sessions that remain valid after a password change. This could lead to unauthorized access to data or functions available to the impersonated user, impacting confidentiality, integrity, and availability to a limited extent. The CVSS score of 6.3 reflects a medium severity impact with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider enforcing manual session invalidation policies after password changes and monitor for unusual session activity. Follow IBM's official advisories for updates on patches or mitigations.