IBM Sterling Secure Proxy
At a glance
- Source
- NVD
- EPSS
- EPSS 3.25 % · percentile 88 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- ibm
- NVD status
- Modified
Description
IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181482.
Weaknesses (CWE)
- CWE-611 — Improper Restriction of XML External Entity Reference
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.2 | CVSS:3.0/S:U/AC:L/I:N/A:L/C:H/UI:N/PR:N/AV:N/RC:C/E:U/RL:O | ibm |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | HIGH 8.2 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L | NVD · psirt@us.ibm.com (Secondary) |
| CVSS 2.0 | MEDIUM 6.4 | AV:N/AC:L/Au:N/C:P/I:N/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-25709
- GCVE · GCVE-0-2020-4462
Affected configurations (NVD CPE)
cpe:2.3:a:ibm:sterling_external_authentication_server:2.4.2.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_external_authentication_server:2.4.3.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_external_authentication_server:6.0.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_external_authentication_server:6.0.1.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_secure_proxy:3.4.2.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_secure_proxy:3.4.3.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_secure_proxy:6.0.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:sterling_secure_proxy:6.0.1.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| IBM · Sterling Secure Proxy | affected 3.4.2 ; affected 3.4.3 ; affected 2.4.3 ; affected 2.4.2 ; affected 6.0.1 ; affected 6.0.0 |
| IBM · External Authentication Server | affected 6.0 ; affected 6.0.1 |
| IBM · Sterling External Authentication Server | affected 2.4.2 ; affected 2.4.3.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |