Lucene search

IBMB99969DC6068219032AFFD103642D839B5F179C3C759834FE303D797775898BC

HistoryJul 30, 2021 - 5:06 a.m.

Security Bulletin: Unrestricted document type definition vulnerability affects IBM Sterling Secure Proxy

2021-07-3005:06:21

www.ibm.com

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

23.2%

JSON

Summary

IBM Sterling Secure Proxy is affected by an unrestricted document type definition vulnerability. IBM Sterling Secure Proxy has addressed the applicable CVEs.

Vulnerability Details

CVEID:CVE-2021-29749
**DESCRIPTION:**IBM Sterling Secure Proxy is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/201777 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Secure Proxy	6.0.2

Remediation/Fixes

Product

VRMF

iFix

Remediation/First Fix

—|—|—|—

IBM Secure Proxy

6.0.2.0

iFix 2

Fix Central

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm sterling secure proxyeq6.0.2

CPE	Name	Operator	Version
	ibm sterling secure proxy	eq	6.0.2

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

23.2%

JSON

Related for B99969DC6068219032AFFD103642D839B5F179C3C759834FE303D797775898BC