8.2
High
CVE-2020-4462 IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0,…
Description
IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181482.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Sterling Secure Proxy 6.0 | 6.0.0 → 6.0.1 | No fix stated |
| Sterling Secure Proxy 3.4 | 3.4.2 → 3.4.3 | No fix stated |
| Sterling Secure Proxy 2.4 | 2.4.2 → 2.4.3 | No fix stated |
| External Authentication Server 6.0 | 6.0 → 6.0.1 | No fix stated |
| Sterling External Authentication Server 2.4 | 2.4.2 → 2.4.3.2 | No fix stated |
Other CVEs of Sterling Secure Proxy
The 19 CVEs of Sterling Secure Proxy →
CVE-2026-75792
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative…
4.3
Medium
CVE-2026-78415
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and…
5.4
Medium
CVE-2024-51453
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.0.1 could allow a remote attacker to traverse directories on the system
4.3
Medium
CVE-2024-38341
IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than…
5.9
Medium