Skip to main content

Security Identity Governance And Intelligence CVE-2020-4248

LOW
Error Message Information Leak (CWE-209)
2020-05-28 psirt@us.ibm.com
2.7
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
2.7 LOW
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
May 28, 2020 - 16:15 nvd
LOW 2.7

DescriptionNVD

IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 175484.

AnalysisAI

IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-209. IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 175484. Affected products include: Ibm Security Identity Governance And Intelligence.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2018-1756 HIGH POC
7.5 Sep 07

IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. Rated high severity

CVE-2017-1407 HIGH
8.8 Sep 28

IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbit

CVE-2017-1483 HIGH
8.6 Sep 28

IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or f

CVE-2020-4245 HIGH
7.5 May 28

IBM Security Identity Governance and Intelligence 5.2.6 does not require that users should have strong passwords by defa

CVE-2020-4232 HIGH
7.5 May 28

IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid log

CVE-2020-4246 HIGH
7.1 May 28

IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack w

CVE-2020-4249 MEDIUM
6.5 May 28

IBM Security Identity Governance and Intelligence 5.2.6 could disclose highly sensitive information to other authenticat

CVE-2020-4231 MEDIUM
6.5 May 28

IBM Security Identity Governance and Intelligence 5.2.6 could allow an authenticated user to perform unauthorized comman

CVE-2020-4244 MEDIUM
5.3 May 28

IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive information

CVE-2020-4233 MEDIUM
5.3 May 28

IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, c

CVE-2018-1757 MEDIUM
5.3 Sep 07

IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive informat

CVE-2020-4243 LOW
3.7 Aug 05

IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensit

Share

CVE-2020-4248 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy