CVE-2020-4462

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181482.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
IBM	Sterling Secure Proxy	3.4.2; 3.4.3; 2.4.3; 2.4.2; 6.0.1; 6.0.0
IBM	External Authentication Server	6.0; 6.0.1
IBM	Sterling External Authentication Server	2.4.2; 2.4.3.2

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/181482VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6249317Vendor Advisory
https://www.ibm.com/support/pages/node/6249331Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/181482VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6249317Vendor Advisory
https://www.ibm.com/support/pages/node/6249331Vendor Advisory

Timeline

Published: Jul 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-44638.2IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A r CVE-2020-44648.8IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with CVE-2020-44656.5IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS is vulnerable to a buffer overflow vulnerability due to an err CVE-2020-44666.5IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due to an error within th CVE-2020-44677.8IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by memory corruption CVE-2020-44687.8IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by memory corruption CVE-2020-44699.8IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially CVE-2020-44708.0IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which CVE-2020-44716.5IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions CVE-2020-44756.5IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sen CVE-2020-44767.5IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information CVE-2020-44776.5IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be us