CVE-2019-4689

Vulnerability

IBM Security Guardium Data Encryption (GDE) version 3.0.0.2 fails to properly enable HTTP Strict Transport Security (HSTS) [1]. Without HSTS, a remote attacker can intercept or modify communications between a client and the server, potentially obtaining sensitive information transmitted over HTTP after an initial HTTPS connection [1].

Exploitation

An attacker positioned on the network (e.g., man-in-the-middle) can exploit the missing HSTS header to downgrade connections or intercept subsequent HTTP requests [1]. No authentication is required for the attacker to perform this interception; user interaction may be limited to the normal operation of the affected service.

Impact

Successful exploitation allows an attacker to obtain sensitive information transmitted between the client and GDE server, leading to a confidentiality breach [1]. The vulnerability does not directly allow code execution or privilege escalation.

Mitigation

IBM has addressed this issue in a security update; administrators should apply the fix referenced in IBM X-Force ID 171826 and the associated security bulletin [1]. No workarounds are publicly documented, and the product is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.