Sign-up

ID

VAR-202103-0668


CVE

CVE-2020-4831


TITLE

IBM DataPower Gateway  Vulnerability in using cryptographic algorithms in

Trust: 0.8

sources: JVNDB: JVNDB-2021-004467

DESCRIPTION

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 189965. Vendor exploits this vulnerability IBM X-Force ID: 189965 Is published as.Information may be obtained. IBM DataPower Gateway is a security and integration platform specially designed for mobile, cloud, application programming interface (API), network, service-oriented architecture (SOA), B2B and cloud workloads. The platform secures, integrates and optimizes access across channels with a dedicated gateway platform

Trust: 1.71

sources: NVD: CVE-2020-4831 // JVNDB: JVNDB-2021-004467 // VULHUB: VHN-182956

AFFECTED PRODUCTS

vendor:ibmmodel:datapower gatewayscope:gteversion:10.0.0.0

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:lteversion:10.0.1.0

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:10.0.0.0 to 10.0.1.0

Trust: 0.8

vendor:ibmmodel:datapower gatewayscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-004467 // NVD: CVE-2020-4831

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-4831
value: HIGH

Trust: 1.0

psirt@us.ibm.com: CVE-2020-4831
value: MEDIUM

Trust: 1.0

NVD: CVE-2020-4831
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202103-843
value: HIGH

Trust: 0.6

VULHUB: VHN-182956
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-4831
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-182956
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-4831
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

psirt@us.ibm.com: CVE-2020-4831
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.0

Trust: 1.0

NVD: CVE-2020-4831
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-182956 // JVNDB: JVNDB-2021-004467 // CNNVD: CNNVD-202103-843 // NVD: CVE-2020-4831 // NVD: CVE-2020-4831

PROBLEMTYPE DATA

problemtype:CWE-327

Trust: 1.1

problemtype:Use of incomplete or dangerous cryptographic algorithms (CWE-327) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-182956 // JVNDB: JVNDB-2021-004467 // NVD: CVE-2020-4831

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202103-843

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-202103-843

PATCH

title:6398744 IBM X-Force Exchangeurl:https://www.ibm.com/support/pages/node/6398744

Trust: 0.8

title:IBM DataPower Gateway Fixes for encryption problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=144559

Trust: 0.6

sources: JVNDB: JVNDB-2021-004467 // CNNVD: CNNVD-202103-843

EXTERNAL IDS

db:NVDid:CVE-2020-4831

Trust: 2.5

db:JVNDBid:JVNDB-2021-004467

Trust: 0.8

db:CNNVDid:CNNVD-202103-843

Trust: 0.7

db:VULHUBid:VHN-182956

Trust: 0.1

sources: VULHUB: VHN-182956 // JVNDB: JVNDB-2021-004467 // CNNVD: CNNVD-202103-843 // NVD: CVE-2020-4831

REFERENCES

url:https://www.ibm.com/support/pages/node/6398744

Trust: 1.7

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/189965

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2020-4831

Trust: 1.4

url:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-vulnerability-in-tls-cve-2020-4831/

Trust: 0.6

url:https://vigilance.fr/vulnerability/ibm-datapower-gateway-man-in-the-middle-via-weak-cryptographic-algorithms-35797

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-vulnerability-in-tls-cve-2020-4831/

Trust: 0.6

sources: VULHUB: VHN-182956 // JVNDB: JVNDB-2021-004467 // CNNVD: CNNVD-202103-843 // NVD: CVE-2020-4831

SOURCES

db:VULHUBid:VHN-182956
db:JVNDBid:JVNDB-2021-004467
db:CNNVDid:CNNVD-202103-843
db:NVDid:CVE-2020-4831

LAST UPDATE DATE

2024-11-23T22:47:41.136000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-182956date:2021-03-18T00:00:00
db:JVNDBid:JVNDB-2021-004467date:2021-11-22T08:59:00
db:CNNVDid:CNNVD-202103-843date:2021-07-01T00:00:00
db:NVDid:CVE-2020-4831date:2024-11-21T05:33:17.950

SOURCES RELEASE DATE

db:VULHUBid:VHN-182956date:2021-03-12T00:00:00
db:JVNDBid:JVNDB-2021-004467date:2021-11-22T00:00:00
db:CNNVDid:CNNVD-202103-843date:2021-03-11T00:00:00
db:NVDid:CVE-2020-4831date:2021-03-12T17:15:12.270