CVE-2020-4805

Vulnerability

IBM Edge version 4.2 allows web pages to be stored in a local cache that is readable by another user on the same system. The vulnerability stems from insecure file permissions or storage location, enabling cross-user data leakage. [1]

Exploitation

An attacker with local access to the system can read the cached web pages stored by IBM Edge. No authentication or special privileges are required beyond the ability to browse the local file system. The attacker must have a local user account on the same machine. [1]

Impact

Successful exploitation results in the disclosure of cached web page content, which may include sensitive information such as session tokens or personal data. The confidentiality impact is low, and there is no impact on integrity or availability. The CVSS base score is 4.0 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). [1]

Mitigation

IBM provides a fix by delivering updated Docker images that are automatically pulled and deployed from Docker Hub and the IBM Entitled Registry. Users should ensure their deployment pulls the latest images. No workarounds are available. [1]