CVE-2019-4631

Vulnerability

IBM Security Secret Server 10.7 (all versions prior to fixpack 10.7.000059) contains an open redirect vulnerability. An attacker can craft a specially-crafted URL that, when visited by a victim, redirects them to an arbitrary external site. The vulnerability exists in the web application's handling of redirect parameters. [1]

Exploitation

An attacker can exploit this vulnerability by sending a phishing link to a victim, persuading them to click on it. No authentication is required, and the attack is performed remotely over the network. The victim must interact by clicking the link. The attacker can spoof the URL displayed to appear as a trusted IBM Security Secret Server domain, but the actual redirect goes to a malicious site. [1]

Impact

Successful exploitation allows the attacker to redirect users to a malicious website that appears trusted. This can lead to the disclosure of sensitive information or further attacks against the victim, such as credential theft or malware installation. The CVSS score is 7.4 (High) with integrity impact high, scope changed, and no confidentiality or availability impact. [1]

Mitigation

IBM released fixpack 10.7.000059 to address this vulnerability. Users should upgrade to this version or later. No workarounds are available. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog as of the publication date. [1]