CVE-2020-4226

IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to information disclosure…

Medium5.9EPSS 1.3%

Published: 27 May 2020
Updated: 17 Sept 2024
Reserved: 30 Dec 2019
Assigned by: ibm

Description

IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 175207.

Timeline

2019
30 Dec 2019
30 Dec 2019
ID reserved
By ibm
2020
27 May 20205 months later
27 May 2020· 5 months later
Published
2024
17 Sept 20244 years later
17 Sept 2024· 4 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-4226, by who scored it
Scored by	CVSS	Score	Vector
ibmCNA (assigner)	3.0	Medium5.9	CVSS:3.0/PR:N/A:N/I:N/C:H/AV:N/S:U/AC:H/UI:N/RL:O/E:U/RC:C
NVDNVD · Modified	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (exploitation in 30 days): 1.3% · top 29% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

Obtain Information
CWE-200 (opens in a new tab)All about CWE-200 and its CVEs

Affected products

IBM · MobileFirst Platform Foundation
- affected 8.0.0.0

References (2)

https://www.ibm.com/support/pages/node/6216813 (opens in a new tab)x_refsource_CONFIRMx_transferred
ibm-worklight-cve20204226-info-disc (175207) (opens in a new tab)vdb-entryx_refsource_XFx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-4226](https://trackcve.app/badge/CVE-2020-4226.svg)](https://trackcve.app/cve/CVE-2020-4226)

Record last updated 17 Sept 2024, 03:59 UTC.