cnvd - cnvd-2024-14665

cnvd-2024-14665

Vulnerability from cnvd

Title: IBM Sterling Secure Proxy信息泄露漏洞（CNVD-2024-14665）

Description:

IBM Sterling Secure Proxy是美国国际商业机器（IBM）公司的一个用于确保组织非保护区(DMZ)中文件安全传输的应用程序代理。

IBM Sterling Secure Proxy 6.0.3版本和6.1.0版本存在信息泄露漏洞，该漏洞源于将网页存储在本地，攻击者可利用该漏洞导致系统上的其他用户读取这些网页。

Severity: 低

Patch Name: IBM Sterling Secure Proxy信息泄露漏洞（CNVD-2024-14665）的补丁

Patch Description:

IBM Sterling Secure Proxy是美国国际商业机器（IBM）公司的一个用于确保组织非保护区(DMZ)中文件安全传输的应用程序代理。

IBM Sterling Secure Proxy 6.0.3版本和6.1.0版本存在信息泄露漏洞，该漏洞源于将网页存储在本地，攻击者可利用该漏洞导致系统上的其他用户读取这些网页。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/7142038

Reference: https://exchange.xforce.ibmcloud.com/vulnerabilities/269686

Impacted products

Name
['IBM Sterling Secure Proxy 6.0.3', 'IBM Sterling Secure Proxy 6.1.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-46181"
    }
  },
  "description": "IBM Sterling Secure Proxy\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u7528\u4e8e\u786e\u4fdd\u7ec4\u7ec7\u975e\u4fdd\u62a4\u533a(DMZ)\u4e2d\u6587\u4ef6\u5b89\u5168\u4f20\u8f93\u7684\u5e94\u7528\u7a0b\u5e8f\u4ee3\u7406\u3002\n\nIBM Sterling Secure Proxy 6.0.3\u7248\u672c\u548c6.1.0\u7248\u672c\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5c06\u7f51\u9875\u5b58\u50a8\u5728\u672c\u5730\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7cfb\u7edf\u4e0a\u7684\u5176\u4ed6\u7528\u6237\u8bfb\u53d6\u8fd9\u4e9b\u7f51\u9875\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/7142038",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-14665",
  "openTime": "2024-03-26",
  "patchDescription": "IBM Sterling Secure Proxy\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u7528\u4e8e\u786e\u4fdd\u7ec4\u7ec7\u975e\u4fdd\u62a4\u533a(DMZ)\u4e2d\u6587\u4ef6\u5b89\u5168\u4f20\u8f93\u7684\u5e94\u7528\u7a0b\u5e8f\u4ee3\u7406\u3002\r\n\r\nIBM Sterling Secure Proxy 6.0.3\u7248\u672c\u548c6.1.0\u7248\u672c\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5c06\u7f51\u9875\u5b58\u50a8\u5728\u672c\u5730\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7cfb\u7edf\u4e0a\u7684\u5176\u4ed6\u7528\u6237\u8bfb\u53d6\u8fd9\u4e9b\u7f51\u9875\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Sterling Secure Proxy\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2024-14665\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Sterling Secure Proxy 6.0.3",
      "IBM Sterling Secure Proxy 6.1.0"
    ]
  },
  "referenceLink": "https://exchange.xforce.ibmcloud.com/vulnerabilities/269686",
  "serverity": "\u4f4e",
  "submitTime": "2024-03-19",
  "title": "IBM Sterling Secure Proxy\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2024-14665\uff09"
}

CVE-2023-46181 (GCVE-0-2023-46181)

Vulnerability from cvelistv5

Published

2024-03-15 15:13

Modified

2024-08-02 20:37

Severity ?

4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-525 - Information Exposure Through Browser Caching

Summary

IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 269686.

References

▼	URL	Tags
	https://www.ibm.com/support/pages/node/7142038	vendor-advisory
	https://exchange.xforce.ibmcloud.com/vulnerabilities/269686	vdb-entry

Impacted products

	Vendor	Product	Version
	IBM	Secure Proxy	Version: 6.0.3, 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46181",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-15T19:21:47.620024Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:09.642Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:37:40.058Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/7142038"
          },
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/269686"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Secure Proxy",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.3, 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system.  IBM X-Force ID:  269686."
            }
          ],
          "value": "IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system.  IBM X-Force ID:  269686."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-525",
              "description": "CWE-525 Information Exposure Through Browser Caching",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-15T15:13:49.550Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/7142038"
        },
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/269686"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Secure Proxy information disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2023-46181",
    "datePublished": "2024-03-15T15:13:49.550Z",
    "dateReserved": "2023-10-17T22:30:38.108Z",
    "dateUpdated": "2024-08-02T20:37:40.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted