CVE-2021-20414 Denial of service in Guardium Data Encryption
Attackers can brute force sensitive information in IBM Guardium Data Encryption due to insufficient rate limiting on interactions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20414?
CVE-2021-20414 is a medium-severity denial of service vulnerability in IBM Guardium Data Encryption, published on 12 Jul 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
IBM Guardium Data Encryption (GDE) 3.0.0.2 could allow a user to bruce force sensitive information due to not properly limiting the number of interactions. IBM X-Force ID: 196216.
Which versions are affected by CVE-2021-20414?
It affects 1 product.
Products include Ibm Guardium Data Encryption.
How do I fix CVE-2021-20414?
No fix has been published for CVE-2021-20414 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-20414 being exploited?
There is no known exploitation of CVE-2021-20414 in the wild and no public exploit code.
Other vulnerabilities in IBM Guardium Data Encryption
- CVE-2019-4713 Command injection in Security Guardium Data Encryption
- CVE-2019-4698 Weak cryptography in Security Guardium Data Encryption
- CVE-2019-4694 Hardcoded credentials in Security Guardium Data Encryption
- CVE-2021-20474 Missing authorization in Guardium Data Encryption
- CVE-2021-20378 Auth bypass in Guardium Data Encryption
Sources
Also known as GHSA-95w5-wfx4-75p8.