PT-2020-17928 · Ibm · Ibm Mobilefirst Platform Foundation

Published 2020-05-27 · Updated 2020-05-28 · CVE-2020-4226

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM MobileFirst Platform Foundation version 8.0.0.0

Description The issue concerns the storage of highly sensitive information in URL parameters, which may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header, or browser history.

Recommendations For IBM MobileFirst Platform Foundation version 8.0.0.0, consider modifying the application to store sensitive information in a more secure manner, such as using secure cookies or tokens, to prevent exposure through URL parameters. As a temporary workaround, restrict access to server logs and ensure that browser history is properly secured to minimize the risk of unauthorized access.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-4226

Affected Products

Ibm Mobilefirst Platform Foundation

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/175207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4226 · Security Note
• https://ibm.com/support/pages/node/6216813 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4226 · Vendor Advisory