PT-2020-17931 · Ibm · Ibm Security Identity Governance/Intelligence

Chris Shepherd + 8 · Published 2020-05-28 · Updated 2021-07-21 · CVE-2020-4232

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Identity Governance and Intelligence version 5.2.6

Description The issue allows an attacker to enumerate usernames to find valid login credentials, which could be used to attempt further attacks against the system.

Recommendations For IBM Security Identity Governance and Intelligence version 5.2.6, consider restricting access to sensitive areas of the system to minimize the risk of exploitation. As a temporary workaround, limit the ability to enumerate usernames until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2020-4232

Affected Products

Ibm Security Identity Governance/Intelligence

References · 5

• https://ibm.com/support/pages/node/6207906 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4232 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/175336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4232 · Security Note
• https://t.me/cvenotify/4072 · Telegram Post