CVE-2019-4695

Vulnerability

IBM Guardium Data Encryption (GDE) version 3.0.0.2 stores web pages locally on the system without adequate protection. This allows the content of those cached pages, which may contain sensitive information, to be read by another user on the same system. The vulnerability exists in the default configuration of GDE 3.0.0.2 [1].

Exploitation

An attacker must have local access to the system where GDE 3.0.0.2 is installed. No authentication or user interaction is required beyond being able to read the local file system where the web pages are stored. The attacker can simply navigate to the storage location and view the cached page contents [1].

Impact

By reading locally stored web pages, an attacker can obtain sensitive information that should have been restricted, leading to a breach of confidentiality. The impact is limited to information disclosure and does not grant elevated privileges or system control [1].

Mitigation

IBM has fixed this vulnerability in Guardium Data Encryption version 4.0.0.0. Users should upgrade to the latest version to receive the fix. No workarounds are documented for the affected version [1].