CVE-2021-39021

Vulnerability

IBM Guardium Data Encryption (GDE) version 5.0.0.2 (also known as CipherTrust Manager 2.4.2) contains a vulnerability where the system sends different responses under different circumstances in a way that is observable to an unauthorized actor. This behavior could facilitate username enumeration, allowing an attacker to determine valid usernames based on the application's responses [1].

Exploitation

An attacker with network access to the GDE server can exploit this vulnerability by sending crafted requests and observing the application's responses. The attack complexity is high, but no authentication is required, and no user interaction is needed. The attacker can use the observable differences in responses to enumerate valid usernames [1].

Impact

Successful exploitation allows an attacker to identify valid usernames within the system. This information disclosure (confidentiality impact is low) could be used as a stepping stone for further targeted attacks, such as password guessing or social engineering. The integrity and availability of the system are not affected [1].

Mitigation

IBM has released a fix in the latest version of GDE. Users should apply the patch or update to the latest GDE version available from the Thales support portal [1].