User Enumeration Vulnerability in IBM Sterling File Gateway
CVE-2021-20376

4.3MEDIUM

Key Information:

Vendor
IBM
Status
Sterling File Gateway
Vendor
CVE Published:
7 October 2021

Summary

An issue in IBM Sterling File Gateway versions 2.2.0.0 through 6.1.1.0 permits authenticated attackers to exploit discrepancies in message responses, enabling them to enumerate valid usernames. This vulnerability arises from varying feedback provided during user authentication attempts, which may reveal the existence of certain accounts within the system. Organizations utilizing affected versions are strongly encouraged to apply the latest security updates to mitigate potential risks.

Affected Version(s)

Sterling File Gateway 2.2.0.0

Sterling File Gateway 6.0.0.0

Sterling File Gateway 5.2.6.5_3

References

https://www.ibm.com/support/pages/node/6496789
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/195568
vdb-entryx_refsource_XF

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.