CVE-2020-4681: 
IBM Guardium Appliance vulnerability analysis and mitigation

IBM Security Guardium 11.2 is vulnerable to cross-site scripting (CVE-2020-4681). This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session. The vulnerability was disclosed on October 9, 2020 (NVD, IBM Advisory).

The vulnerability has a CVSS v3.1 Base Score of 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The attack vector is Network-based, with Low attack complexity, requiring Low privileges and User interaction. The scope is Changed, with Low impact on both Confidentiality and Integrity, and No impact on Availability (AttackerKB).

The vulnerability could allow attackers to alter the intended functionality of the Web UI and potentially lead to credentials disclosure within a trusted session. The impact is considered moderate as it requires user interaction and low privileges to exploit (IBM Advisory).

The vulnerability requires low privileges and user interaction to exploit. The attack can be conducted over the network, and the attack complexity is considered low. However, successful exploitation requires a legitimate user to interact with malicious content (AttackerKB).

IBM has released security fixes for affected versions of Security Guardium (11.0, 11.1, and 11.2). Users are advised to update their installations to the latest version through IBM Fix Central (IBM Advisory).