CVE-2020-4763: Medium severity ibm sterling file gateway vulnerability
IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 188897.
Other sources
IBM Sterling File Gateway does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-4763.
What is the severity of CVE-2020-4763?
The severity of CVE-2020-4763 is medium with a CVSS score of 4.3.
Which versions of IBM Sterling File Gateway are affected by CVE-2020-4763?
IBM Sterling File Gateway versions 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 are affected.
How can attackers exploit CVE-2020-4763?
Attackers may be able to exploit CVE-2020-4763 by getting the cookie values from users through http:// links or by planting such links in websites visited by the users.
How can I fix CVE-2020-4763?
To fix CVE-2020-4763, you should apply the available patches provided by IBM.