PT-2021-3236 · Ibm · Ibm Security Verify Access

Chris Shepherd + 7 · Published 2021-05-31 · Updated 2021-06-07 · CVE-2021-20575

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access version 20.07

Description The issue is related to the storage of web pages locally, which can be accessed by another user on the system. This is due to the insecure storage of confidential information. Exploitation of this issue may allow an attacker to gain unauthorized access to protected information.

Recommendations For IBM Security Verify Access version 20.07, consider implementing access controls to restrict unauthorized users from reading locally stored web pages until a fix is available. As a temporary workaround, restrict access to sensitive information stored locally to minimize the risk of exploitation.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

BDU:2021-02948

CVE-2021-20575

Affected Products

Ibm Security Verify Access

References · 7

• https://ibm.com/support/pages/node/6457315 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/199278 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02948 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-20575 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20575 · Vendor Advisory
• https://ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-have-been-resolved-in-ibm-application-gateway-cve-2021-20576-cve-2021-20575-cve-2021-29665 · Note
• https://t.me/cvenotify/15714 · Telegram Post