CVE-2020-4462high

CVE-2020-4462: high-severity vulnerability in IBM Sterling External Authentication Server

Published · Updated

Follow this CVE+ Monitor Sterling Secure Proxy+ Monitor Sterling External Authentication Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 3.2%
IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181482.
CVSS:3.0/S:U/AC:L/I:N/A:L/C:H/UI:N/PR:N/AV:N/RC:C/E:U/RL:O
Affected products
IBM · External Authentication ServerIBM · Sterling External Authentication ServerIBM · Sterling Secure Proxy
Related CVEs — IBM Sterling External Authentication Server

In the same product, most dangerous first.

CVE-2022-22336HIGHCVE-2022-22336EPSS 2.0%CVE-2022-22349MEDIUMCVE-2022-22349EPSS 1.0%CVE-2021-29728MEDIUMCVE-2021-29728EPSS 1.0%CVE-2021-29723MEDIUMCVE-2021-29723EPSS 0.9%CVE-2021-29722MEDIUMCVE-2021-29722EPSS 0.9%CVE-2021-29726MEDIUMCVE-2021-29726EPSS 0.9%