The vulnerability in IBM Maximo Application Suite 9.0, 9.1, and 9.2 involves the absence of the 'Secure' attribute on authorization tokens or session cookies. Without this attribute, cookies intended for HTTPS sessions may be sent over unencrypted HTTP connections if a user accesses an HTTP link, enabling an attacker to capture these cookies by intercepting network traffic. This issue is identified as CWE-614 and affects the confidentiality of session cookies, potentially allowing unauthorized access to user sessions.

The impact is limited to the confidentiality of session cookies. Attackers may obtain cookie values by tricking users into accessing HTTP links or by embedding such links in websites the user visits. This can lead to session hijacking or unauthorized access if the cookies are used for authentication. However, the vulnerability does not affect integrity or availability and requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid accessing IBM Maximo Application Suite over unsecured HTTP connections and ensure that all links to the application use HTTPS. Administrators should monitor vendor updates for official patches or configuration changes that enforce the 'Secure' attribute on cookies.