Session Cookie Security Flaw in IBM Sterling File Gateway
CVE-2020-4665

4.3MEDIUM

Key Information:

Vendor
IBM
Vendor
CVE Published:
16 November 2020

Summary

The IBM Sterling File Gateway has a security vulnerability where the secure attribute is not set on authorization tokens and session cookies. This oversight allows attackers to exploit the vulnerability by sending malicious links to unsuspecting users. When users click on these links, their cookies are sent over insecure HTTP connections, potentially allowing attackers to intercept sensitive cookie values through traffic snooping. It is crucial for users and administrators of affected versions to implement mitigation strategies to protect against unauthorized access to sensitive session information.

Affected Version(s)

Sterling File Gateway 2.2.0.0

Sterling File Gateway 6.0.3.2

Sterling File Gateway 2.2.6.5

References

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.