IBM Sterling External Authentication Server vulnerabilities

11 CVEs affecting IBM Sterling External Authentication Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-29261, published 2023-09-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4462, published 2020-07-16. High severity, CVSS 8.2. EPSS: 3.2% chance of exploitation in the next 30 days. IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE)…
CVE-2022-22336, published 2022-02-23. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume resources causing a denial of service due to a resource…
CVE-2022-22349, published 2022-02-24. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI configuration data. An authorized user could import…
CVE-2021-29728, published 2021-08-30. Medium severity, CVSS 4.9. EPSS: 1% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound…
CVE-2021-29723, published 2021-08-30. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-ForceID:…
CVE-2021-29722, published 2021-08-30. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID:…
CVE-2013-0517, published 2020-02-11. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0, 2.3.01, 2.4.0, and 2.4.1 via an unspecified OS command, which could let a local malicious user execute…
CVE-2022-22333, published 2022-02-23. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable a buffer overflow, due to the Jetty based GUI in the Secure Zone not properly…
CVE-2023-32338, published 2023-09-05. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy and IBM Sterling External Authentication Server 6.0.3 and 6.1.0 stores user credentials in plain clear text which can be read by a local user with container access. IBM…
CVE-2023-29261, published 2023-09-05. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow a local user with specific information about the system to obtain privileged information due to inadequate memory clearing during operations. …

Latest

CVE-2022-35720, published 2023-02-08. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms during installation that could allow a local attacker to…