CVE-2021-29846

Vulnerability

IBM Security Guardium Insights version 3.0 contains a vulnerability where session expiration is insufficient. This allows an authenticated user to access sensitive information that should have been protected after session timeout. The issue is present in the default configuration and does not require any special conditions beyond being an authenticated user. [1]

Exploitation

An attacker must be an authenticated user with high privileges (CVSS PR:H). The attacker can exploit the insufficient session expiration by reusing a session token that should have expired, thereby gaining access to sensitive data. No user interaction is required, and the attack can be carried out over the network. [1]

Impact

Successful exploitation results in low confidentiality impact (C:L), meaning the attacker can obtain limited sensitive information. There is no impact on integrity or availability. The attacker does not gain elevated privileges beyond their own authenticated session. [1]

Mitigation

IBM has addressed this vulnerability in a security update. Users should apply the fix provided in the IBM Security Guardium Insights security bulletin. The bulletin details the fixed version and installation instructions. No workarounds are documented. [1]