CVE-2020-4665: Medium severity ibm sterling file gateway vulnerability
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 186280.
Other sources
IBM Sterling File Gateway does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue in IBM Sterling File Gateway?
The vulnerability ID for this issue in IBM Sterling File Gateway is CVE-2020-4665.
What is the severity level of CVE-2020-4665 in IBM Sterling File Gateway?
The severity level of CVE-2020-4665 in IBM Sterling File Gateway is medium.
What can attackers do if they exploit CVE-2020-4665 in IBM Sterling File Gateway?
Attackers may be able to obtain cookie values by sending HTTP links or planting malicious links in websites the user visits.
How can I fix the vulnerability CVE-2020-4665 in IBM Sterling File Gateway?
To fix the vulnerability CVE-2020-4665 in IBM Sterling File Gateway, it is recommended to apply the latest patches provided by IBM.
Where can I find the patches to fix CVE-2020-4665 in IBM Sterling File Gateway?
You can find the patches to fix CVE-2020-4665 in IBM Sterling File Gateway on the IBM Support website.