PT-2020-17918 · Ibm · Ibm Datapower Gateway

Published 2020-03-19 · Updated 2020-03-20 · CVE-2020-4205

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.8

Description The issue allows an authenticated user to bypass security restrictions and continue accessing the server even after authentication certificates have been revoked.

Recommendations For IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.8, update to a version that includes a fix for this issue to prevent authenticated users from bypassing security restrictions after certificate revocation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-4205

Affected Products

Ibm Datapower Gateway

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/174961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4205 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4205 · Vendor Advisory
• https://ibm.com/support/pages/node/6090886 · Note