CVE-2021-20378

Vulnerability

IBM Guardium Data Encryption (GDE) versions 3.0.0.2 and 4.0.0.4 do not properly invalidate a user's session upon logout [1]. This session management flaw allows a previously authenticated session to remain valid after the user explicitly signs out, enabling session reuse.

Exploitation

An attacker must first be an authenticated user on the system. After a legitimate user performs a logout, the attacker who has access to the same system or network can reuse the stale session token to impersonate the original user [1]. No additional privileges are required beyond authenticated access.

Impact

A successful attack allows the attacker to impersonate another authenticated user, gaining the same level of access and privileges as that user. This could lead to unauthorized information disclosure, data modification, or other malicious actions with the victim's permissions [1].

Mitigation

IBM released GDE version 4.0.0.5 which fixes this vulnerability [1]. Users should upgrade to 4.0.0.5 or later. No workaround is documented; applying the fix is the recommended mitigation. The issue is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.