PT-2020-17952 · Ibm · Ibm Sterling File Gateway

Published 2020-05-14 · Updated 2020-05-15 · CVE-2020-4259

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Sterling File Gateway versions 2.2.0.0 through 6.0.3.1

Description The issue allows an authenticated user to manipulate cookie information, potentially removing or adding modules from the cookie to access functionality they are not authorized to.

Recommendations For IBM Sterling File Gateway versions 2.2.0.0 through 6.0.3.1, consider restricting access to sensitive functionality until a patch is available. As a temporary workaround, limit the ability of authenticated users to manipulate cookie information.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-4259

Affected Products

Ibm Sterling File Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-4259 · Security Note
• https://ibm.com/support/pages/node/6208038 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4259 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/175638 · Vendor Advisory
• https://t.me/cvenotify/3788 · Telegram Post