IBM Sterling Secure Proxy
En bref
- Source
- NVD
- EPSS
- EPSS 3.25 % · centile 88 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- ibm
- Statut NVD
- Modified
Rechercher sur…
Description
IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181482.
Faiblesses (CWE)
- CWE-611 — Entité externe XML (XXE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.2 | CVSS:3.0/S:U/AC:L/I:N/A:L/C:H/UI:N/PR:N/AV:N/RC:C/E:U/RL:O | ibm |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | HIGH 8.2 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L | NVD · psirt@us.ibm.com (Secondary) |
| CVSS 2.0 | MEDIUM 6.4 | AV:N/AC:L/Au:N/C:P/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2020-25709
- GCVE · GCVE-0-2020-4462
Configurations affectées (CPE NVD)
cpe:2.3:a:ibm:sterling_external_authentication_server:2.4.2.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_external_authentication_server:2.4.3.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_external_authentication_server:6.0.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_external_authentication_server:6.0.1.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_secure_proxy:3.4.2.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_secure_proxy:3.4.3.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_secure_proxy:6.0.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_secure_proxy:6.0.1.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| IBM · Sterling Secure Proxy | affected 3.4.2 ; affected 3.4.3 ; affected 2.4.3 ; affected 2.4.2 ; affected 6.0.1 ; affected 6.0.0 |
| IBM · External Authentication Server | affected 6.0 ; affected 6.0.1 |
| IBM · Sterling External Authentication Server | affected 2.4.2 ; affected 2.4.3.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |