PT-2022-10844 · Ibm · Ibm Guardium Data Encryption

Ben Goodspeed + 8 · Published 2022-05-05 · Updated 2022-05-13 · CVE-2021-39020

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Encryption (GDE) versions 4.0.0.7 and lower

Description The issue allows sensitive information to be stored in URL parameters, potentially leading to information disclosure if unauthorized parties access the URLs via server logs, referrer headers, or browser history.

Recommendations For IBM Guardium Data Encryption (GDE) versions 4.0.0.7 and lower, consider restricting access to server logs and referrer headers to minimize the risk of exploitation. As a temporary workaround, avoid using sensitive information in URL parameters until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-39020

Affected Products

Ibm Guardium Data Encryption

References · 5

• https://ibm.com/support/pages/node/6579773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39020 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39020 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/213855 · Vendor Advisory
• https://t.me/cibsecurity/42003 · Telegram Post