Medium severity · published Oct 29, 2019
CVE-2019-4311
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 discloses sensitive information to unauthorized users
5.3
CVSS
1.2%
EPSS
No
On KEV
Description
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 161037.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
Security Guardium Big Data Intelligence · Ibm
4.0 · source: NVD
Affected product
SG
Security Guardium Big Data Intelligence
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-4311
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-4311
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/161037
Patch
https://www.ibm.com/support/pages/node/1098069
More from Security Guardium Big Data Intelligence
9.8
CVE-2018-1373
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials
9.8
CVE-2018-1372
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise…
8.2
CVE-2019-4340
IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data
7.8
CVE-2018-1377
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores user credentials in plain in clear text which can be read by a local user
7.5
CVE-2020-4254
IBM Security Guardium Big Data Intelligence 1.0 (SonarG) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information