Security Bulletin: IBM Resilient vulnerable to username enumeration (CVE-2020-4635)

Summary

IBM Resilient could disclose sensitive information by allowing a user to enumerate usernames. An attacker may use this to determine if a user exists or not.

Vulnerability Details

CVEID:CVE-2020-4635
**DESCRIPTION:**IBM Resilient could disclose sensitive information by allowing a user to enumerate usernames.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/185502 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Users must upgrade to v40.1 of IBM Resilient in order to obtain a fix for this vulnerability. This version implements a rate-limiting and fuzzing feature to defend against such attacks.

You can upgrade the platform by following the instructions in the “Upgrade Procedure” section in the IBM Knowledge Center.

Workarounds and Mitigations

None