CVE-2020-4182: XSS
IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174738.
Other sources
IBM Security Guardium is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker needs to cause a user to interact with malicious JavaScript embedded in the Guardium Web UI. The attack requires user interaction but does not require prior privileges.
What could happen if exploitation succeeds?
The injected script can alter intended Web UI functionality and may disclose credentials from a trusted user session. The CVSS vector indicates impacts to confidentiality and integrity, with no availability impact stated.
Which Guardium version is identified as affected?
The provided information specifically identifies IBM Security Guardium 11.1. No other versions are stated.
What remediation is available?
A patch is available. Apply the vendor-provided fix referenced in the IBM support material.