Security Bulletin: IBM Security Verify Governance is vulnerable to sensitive information exposure (CVE-2021-31403)

Summary

IBM Security Verify Governance is vulnerable to sensitive information exposure due to vulnerabilities in Vaadin JAR. The fix involves upgrading the Vaadin JAR to the patched version.

Vulnerability Details

CVEID:CVE-2021-31403
**DESCRIPTION:**Vaadin could allow a local attacker to obtain sensitive information, caused by using Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server. By using a timing attack, an attacker could exploit this vulnerability to guess a security token for Fusion endpoints and then use this information to launch further attacks against the affected system.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200632 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

IBM encourages customers to upgrade their systems promptly.

Affected Product(s)

|

Version(s)

|

First Fix

—|—|—

IBM Security Verify Governance

|

10.0.1

|

10.0.1.0-ISS-ISVG-IGVA-FP0004

Workarounds and Mitigations

None