CVE-2021-39020 Information disclosure in Guardium Data Encryption
Attackers can access sensitive data stored in URL parameters via logs or history, requiring an upgrade to IBM Guardium Data Encryption.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-39020?
CVE-2021-39020 is a low-severity vulnerability in IBM Guardium Data Encryption, published on 5 May 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
IBM Guardium Data Encryption (GDE) 4.0.0.7 and lower stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 213855.
Weakness: CWE-200
Which versions are affected by CVE-2021-39020?
It affects 1 product.
Products include Ibm Guardium Data Encryption.
How do I fix CVE-2021-39020?
No fix has been published for CVE-2021-39020 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-39020 being exploited?
There is no known exploitation of CVE-2021-39020 in the wild and no public exploit code.
Other vulnerabilities in IBM Guardium Data Encryption
- CVE-2019-4713 Command injection in Security Guardium Data Encryption
- CVE-2019-4698 Weak cryptography in Security Guardium Data Encryption
- CVE-2019-4694 Hardcoded credentials in Security Guardium Data Encryption
- CVE-2021-20474 Missing authorization in Guardium Data Encryption
- CVE-2021-20378 Auth bypass in Guardium Data Encryption
Sources
Also known as GHSA-cx5r-3fr2-xpjf.