PT-2021-14055 · Ibm · Ibm Security Secret Server

Published 2021-09-14 · Updated 2022-07-12 · CVE-2021-20582

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: IBM Security Secret Server versions up to 11.0

Description: The issue arises from the storage of sensitive information in URL parameters, potentially leading to information disclosure if unauthorized parties access the URLs through server logs, referrer headers, or browser history.

Recommendations: For IBM Security Secret Server versions up to 11.0, consider implementing measures to restrict access to server logs and referrer headers, and advise users to clear their browser history regularly to minimize the risk of information disclosure. As a temporary workaround, consider configuring the server to not store sensitive information in URL parameters until a more permanent solution is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-20582

Affected Products

Ibm Security Secret Server

References · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/199328 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20582 · Security Note
• https://ibm.com/support/pages/node/6488459 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20582 · Vendor Advisory
• https://t.me/cvenotify/21423 · Telegram Post
• https://t.me/cibsecurity/28824 · Telegram Post