cnvd - cnvd-2021-03528

cnvd-2021-03528

Vulnerability from cnvd

Title: IBM Security Guardium Insights信息泄露漏洞（CNVD-2021-03528）

Description:

IBM Security Guardium Insights是一个现代化的混合云数据安全中心，旨在提供有关组织数据安全性和合规性状况的可靠视图。

IBM Security Guardium Insights 2.0.2存在信息泄露漏洞。该漏洞源于该产品不在授权令牌或会话cookie上设置安全属性。攻击者可通过向用户发送http://链接或将该链接植入用户访问的站点利用该漏洞获取cookie值。

Severity: 中

Patch Name: IBM Security Guardium Insights信息泄露漏洞（CNVD-2021-03528）的补丁

Patch Description:

IBM Security Guardium Insights是一个现代化的混合云数据安全中心，旨在提供有关组织数据安全性和合规性状况的可靠视图。

IBM Security Guardium Insights 2.0.2存在信息泄露漏洞。该漏洞源于该产品不在授权令牌或会话cookie上设置安全属性。攻击者可通过向用户发送http://链接或将该链接植入用户访问的站点利用该漏洞获取cookie值。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/6403463

Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-4597

Impacted products

Name
IBM IBM Security Guardium Insights 2.0.2

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-4597",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-4597"
    }
  },
  "description": "IBM Security Guardium Insights\u662f\u4e00\u4e2a\u73b0\u4ee3\u5316\u7684\u6df7\u5408\u4e91\u6570\u636e\u5b89\u5168\u4e2d\u5fc3\uff0c\u65e8\u5728\u63d0\u4f9b\u6709\u5173\u7ec4\u7ec7\u6570\u636e\u5b89\u5168\u6027\u548c\u5408\u89c4\u6027\u72b6\u51b5\u7684\u53ef\u9760\u89c6\u56fe\u3002\n\nIBM Security Guardium Insights 2.0.2\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8be5\u4ea7\u54c1\u4e0d\u5728\u6388\u6743\u4ee4\u724c\u6216\u4f1a\u8bddcookie\u4e0a\u8bbe\u7f6e\u5b89\u5168\u5c5e\u6027\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5411\u7528\u6237\u53d1\u9001http://\u94fe\u63a5\u6216\u5c06\u8be5\u94fe\u63a5\u690d\u5165\u7528\u6237\u8bbf\u95ee\u7684\u7ad9\u70b9\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6cookie\u503c\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/6403463",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-03528",
  "openTime": "2021-01-16",
  "patchDescription": "IBM Security Guardium Insights\u662f\u4e00\u4e2a\u73b0\u4ee3\u5316\u7684\u6df7\u5408\u4e91\u6570\u636e\u5b89\u5168\u4e2d\u5fc3\uff0c\u65e8\u5728\u63d0\u4f9b\u6709\u5173\u7ec4\u7ec7\u6570\u636e\u5b89\u5168\u6027\u548c\u5408\u89c4\u6027\u72b6\u51b5\u7684\u53ef\u9760\u89c6\u56fe\u3002\r\n\r\nIBM Security Guardium Insights 2.0.2\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8be5\u4ea7\u54c1\u4e0d\u5728\u6388\u6743\u4ee4\u724c\u6216\u4f1a\u8bddcookie\u4e0a\u8bbe\u7f6e\u5b89\u5168\u5c5e\u6027\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5411\u7528\u6237\u53d1\u9001http://\u94fe\u63a5\u6216\u5c06\u8be5\u94fe\u63a5\u690d\u5165\u7528\u6237\u8bbf\u95ee\u7684\u7ad9\u70b9\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6cookie\u503c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Security Guardium Insights\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2021-03528\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "IBM IBM Security Guardium Insights 2.0.2"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-4597",
  "serverity": "\u4e2d",
  "submitTime": "2021-01-14",
  "title": "IBM Security Guardium Insights\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2021-03528\uff09"
}

CVE-2020-4597 (GCVE-0-2020-4597)

Vulnerability from cvelistv5

Published

2021-01-13 18:10

Modified

2024-09-16 19:14

Severity ?

4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C

CWE

Obtain Information

Summary

IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 184822.

References

▼	URL	Tags
	https://www.ibm.com/support/pages/node/6403463	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/184822	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	IBM	Security Guardium Insights	Version: 2.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:07:49.034Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/6403463"
          },
          {
            "name": "ibm-guardium-cve20204597-info-disc (184822)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/184822"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Security Guardium Insights",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.2"
            }
          ]
        }
      ],
      "datePublic": "2021-01-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 184822."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 3.8,
            "temporalSeverity": "LOW",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AC:L/A:N/AV:N/C:L/S:U/I:N/UI:R/PR:N/RC:C/RL:O/E:U",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Obtain Information",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-13T18:10:29",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/pages/node/6403463"
        },
        {
          "name": "ibm-guardium-cve20204597-info-disc (184822)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/184822"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2021-01-12T00:00:00",
          "ID": "CVE-2020-4597",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Security Guardium Insights",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.0.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 184822."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "N",
              "AC": "L",
              "AV": "N",
              "C": "L",
              "I": "N",
              "PR": "N",
              "S": "U",
              "UI": "R"
            },
            "TM": {
              "E": "U",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Obtain Information"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ibm.com/support/pages/node/6403463",
              "refsource": "CONFIRM",
              "title": "IBM Security Bulletin 6403463 (Security Guardium Insights)",
              "url": "https://www.ibm.com/support/pages/node/6403463"
            },
            {
              "name": "ibm-guardium-cve20204597-info-disc (184822)",
              "refsource": "XF",
              "title": "X-Force Vulnerability Report",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/184822"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2020-4597",
    "datePublished": "2021-01-13T18:10:30.002368Z",
    "dateReserved": "2019-12-30T00:00:00",
    "dateUpdated": "2024-09-16T19:14:48.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted