PT-2020-18051 · Ibm · Ibm Verify Gateway

Chris Shepherd + 8 · Published 2020-07-27 · Updated 2020-07-28 · CVE-2020-4405

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Verify Gateway (IVG) versions 1.0.0 through 1.0.1

Description The issue could disclose potentially sensitive information to an authenticated user due to world-readable log files.

Recommendations For versions 1.0.0 and 1.0.1, consider restricting access to the log files to prevent unauthorized disclosure of sensitive information. As a temporary workaround, modify the log file permissions to prevent world-readable access until a fix is available.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2020-4405

Affected Products

Ibm Verify Gateway

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/179484 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4405 · Vendor Advisory
• https://ibm.com/support/pages/node/6252479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4405 · Security Note