CVE-2020-4462

published 2020-07-16

CVE-2020-4462: IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an…

Priority P3 51 high 8.2 CVSS 3.1

AV N AC L PR N UI N S U C H I N A L

IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181482.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
ibm	external_authentication_server	—	—
ibm	external_authentication_server	—	—
ibm	sterling_external_authentication_server	—	—
ibm	sterling_external_authentication_server	—	—
ibm	sterling_external_authentication_server	—	—
ibm	sterling_external_authentication_server	—	—
ibm	sterling_external_authentication_server	—	—
ibm	sterling_secure_proxy	—	—
ibm	sterling_secure_proxy	—	—
ibm	sterling_secure_proxy	—	—
ibm	sterling_secure_proxy	—	—
ibm	sterling_secure_proxy	—	—
ibm	sterling_secure_proxy	—	—
ibm	sterling_secure_proxy	—	—
ibm	sterling_secure_proxy	—	—
ibm	sterling_secure_proxy	—	—
ibm	sterling_secure_proxy	—	—

CVSS provenance

nvd v3.1 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

nvd v3.0 8.2 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

nvd v2.0 6.4 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611