CVE-2020-4171

Vulnerability

IBM Security Guardium Insights version 2.0.1 stores web pages locally on the system. This allows another user on the same system to read those stored web pages, potentially exposing sensitive information. The vulnerability is identified as CVE-2020-4171 and is documented in the IBM security bulletin [1].

Exploitation

An attacker with local access to the system where Guardium Insights is installed can read the stored web pages. No special privileges are required beyond being a user on the system. The attacker can simply access the local file system where the web pages are stored.

Impact

Successful exploitation allows an attacker to read locally stored web pages, which may contain sensitive information such as configuration details, user data, or other confidential content. This leads to information disclosure, compromising confidentiality.

Mitigation

IBM has addressed this vulnerability in a security update. Users should apply the latest patches as provided in the IBM security bulletin [1]. The fixed version is not explicitly stated in the available reference, but the bulletin indicates that the issue has been resolved.