CVE-2020-4188: 
IBM Guardium Appliance vulnerability analysis and mitigation

IBM Security Guardium versions 10.6 and 11.1 were found to contain a vulnerability related to the use of insufficiently random numbers or values in security contexts that depend on unpredictable numbers. The vulnerability was disclosed on June 22, 2020, and was assigned CVE-2020-4188 with IBM X-Force ID 174807 (IBM Security Bulletin).

The vulnerability has been assigned a CVSS Base score of 5.3 with the vector (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can potentially lead to information disclosure (IBM Security Bulletin).

The vulnerability could allow attackers to predict security-related values that are intended to be random, potentially leading to information disclosure. The impact is limited to confidentiality, with no direct effect on integrity or availability of the system (IBM Security Bulletin).

The vulnerability is exploitable over the network and requires low attack complexity. No special privileges or user interaction is needed for exploitation. The attack vector is network-based, making it accessible to remote attackers (IBM Security Bulletin).

IBM has released fixes for affected versions: Security Guardium 10.5, 10.6, 11.0, and 11.1. Users are advised to apply the appropriate patches available through IBM Fix Central. No workarounds are available for this vulnerability (IBM Security Bulletin).

The vulnerability was discovered and reported by the IBM X-Force Ethical Hacking Team members Jonathan Fitz-Gerald, John Zuccato, Rodney Ryan, Chris Shepherd, Nathan Roane, Kamil Sarbinowski, Vince Dragnea and Troy Fisher (IBM Security Bulletin).