CVE-2020-4462

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-16 · updated 2026-06-17
Weakness: CWE-611

Description

IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181482.

Affected products

IBM Sterling External Authentication Server: 2.4.2.0, 2.4.3.2, 6.0.0.0, 6.0.1.0
IBM Sterling Secure Proxy: 3.4.2.0, 3.4.3.0, 6.0.0.0, 6.0.1.0

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/181482
https://www.ibm.com/support/pages/node/6249317
https://www.ibm.com/support/pages/node/6249331
https://exchange.xforce.ibmcloud.com/vulnerabilities/181482
https://www.ibm.com/support/pages/node/6249317
https://www.ibm.com/support/pages/node/6249331

Get alerted when CVE-2020-4462 or the next vulnerability affects your stack