CVE-2021-20417

Vulnerability

IBM Guardium Data Encryption (GDE) version 4.0.0.4 returns detailed technical error messages in the browser when an error occurs. This behavior allows a remote attacker with low privileges to obtain sensitive information that could be used in subsequent attacks against the system. The vulnerability is present in GDE 4.0.0.4 and is triggered without user interaction [1].

Exploitation

An attacker needs network access to the GDE instance and valid low-privilege credentials (PR:L). By sending crafted requests that cause the application to generate errors, the attacker can read the detailed error messages returned in the HTTP response. No special timing or race condition is required [1].

Impact

Successful exploitation results in the disclosure of sensitive information (confidentiality impact: low). The attacker does not gain integrity or availability compromise, but the leaked information can be leveraged to plan more targeted attacks against the system [1].

Mitigation

IBM has fixed this vulnerability in GDE version 4.0.0.5. All users should upgrade to the latest version to obtain the fix. No workaround is documented in the available reference [1].