CVE-2023-47159 — Observable Response Discrepancy in IBM Sterling File Gateway

CWE-204 — Observable Response DiscrepancyCWE-203 — Observable Discrepancy3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 72.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Sterling File Gateway
Timeline
PublishedJan 27

Description

IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to enumerate usernames due to an observable discrepancy in request responses.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5ibm/sterling_file_gateway6.0.0.0 — 6.1.2.5+1
▶NVDibm/sterling_file_gateway6.0.0.0 — 6.1.2.5+1

🔴Vulnerability Details

2
CVEList
IBM Sterling File Gateway information disclosure↗2025-01-27
▶
GHSA
GHSA-q9fm-h69x-8j48: IBM Sterling File Gateway 6↗2025-01-27
▶
CVE-2023-47159 — Observable Response Discrepancy in IBM | cvebase