Session Fixation Vulnerability in IBM Sterling File Gateway

CVE-2021-20473

What is CVE-2021-20473?

The IBM Sterling File Gateway User Interface, from version 2.2.0.0 to 6.1.1.0, fails to invalidate user sessions upon logout. This oversight can be exploited by an authenticated user, allowing them to impersonate another user, thereby accessing sensitive information and functionalities intended solely for the impersonated user. This vulnerability raises significant security concerns for organizations using the affected versions, as it undermines the integrity of user authentication mechanisms.

References