CVE-2021-20473

Published: Oct 7, 2021Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 196944.

Affected (3)

Products: Ibm: Sterling File Gateway

Ibm

1 product

Sterling File Gateway

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Ibm Sterling File Gateway	From 2.2.0.0 to 5.2.6.5_3
Ibm Sterling File Gateway	From 6.0.0.0 to 6.0.3.4
Ibm Sterling File Gateway	From 6.1.0.0 to 6.1.0.1

Related CWEs

CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (4)

https://exchange.xforce.ibmcloud.com/vulnerabilities/196944

Source: psirt@us.ibm.com

VDB EntryVendor Advisory

https://www.ibm.com/support/pages/node/6496785

Source: psirt@us.ibm.com

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/196944

Source: af854a3a-2127-422b-91ae-364da2661108

VDB EntryVendor Advisory

https://www.ibm.com/support/pages/node/6496785

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.