CVE-2020-4665
First published: Fri Nov 13 2020(Updated: )
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 186280.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Sterling File Gateway | >=2.2.0.0<=2.2.6.5 | |
| IBM Sterling File Gateway | >=6.0.0.0<=6.0.3.2 | |
| <=6.0.0.0 - 6.0.3.2 | ||
| <=2.2.0.0 - 2.2.6.5_2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue in IBM Sterling File Gateway?
The vulnerability ID for this issue in IBM Sterling File Gateway is CVE-2020-4665.
What is the severity level of CVE-2020-4665 in IBM Sterling File Gateway?
The severity level of CVE-2020-4665 in IBM Sterling File Gateway is medium.
What can attackers do if they exploit CVE-2020-4665 in IBM Sterling File Gateway?
Attackers may be able to obtain cookie values by sending HTTP links or planting malicious links in websites the user visits.
How can I fix the vulnerability CVE-2020-4665 in IBM Sterling File Gateway?
To fix the vulnerability CVE-2020-4665 in IBM Sterling File Gateway, it is recommended to apply the latest patches provided by IBM.
Where can I find the patches to fix CVE-2020-4665 in IBM Sterling File Gateway?
You can find the patches to fix CVE-2020-4665 in IBM Sterling File Gateway on the IBM Support website.
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/author
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/ibm
- canonical/ibm sterling file gateway
- version/ibm sterling file gateway/2.2.0.0
- version/ibm sterling file gateway/2.2.6.5
- version/ibm sterling file gateway/6.0.0.0
- version/ibm sterling file gateway/6.0.3.2
- version/ibm sterling file gateway/6.0.0.0 - 6.0.3.2
- version/ibm sterling file gateway/2.2.0.0 - 2.2.6.5_2