CVE-2021-39020

Vulnerability

IBM Guardium Data Encryption (GDE) server versions 4.0.0.7 and lower store sensitive information in URL parameters. This vulnerability affects the Vormetric Data Security Manager (DSM) component. The information can be exposed to unauthorized parties who gain access to server logs, referrer headers, or browser history [1].

Exploitation

An attacker must have access to server logs, referrer headers, or browser history where URLs containing sensitive parameters are stored. This requires either direct access to logs, ability to intercept referrer headers, or access to the victim's browser history. The attacker does not need to exploit the application directly; instead, they leverage existing logs or traces of URL data.

Impact

Successful exploitation leads to low confidentiality impact (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) [1]. The attacker can retrieve sensitive information from URL parameters, potentially exposing data such as authentication tokens or other secrets, but not compromising integrity or availability.

Mitigation

IBM recommends applying the fix available through the Thales portal. Users should upgrade to a version higher than 4.0.0.7. No workarounds are available [1]. The vulnerability is disclosed as part of IBM X-Force Ethical Hacking Team findings.