Incorrect default permissions in IBM Sterling File Gateway
Priority LOW 30CWE-276Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could manipulate cookie information and remove or add modules from the cookie to access functionality not authorized to. IBM X-Force ID: 175638.
Why it matters now
EPSS 0.00759 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Sterling File Gateway | 2.2.0.0; 6.0.3.1 | — | No fix listed | CNA |
- Sterling File Gateway VendorIBM Affected 2.2.0.0; 6.0.3.1 Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:* | 2.2.0.0 – 2.2.6.5_1; 6.0.0.0 – 6.0.3.1 | Vulnerable | IBM |
| cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:o:ibm:i:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Oracle |
- cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:* Versions 2.2.0.0 – 2.2.6.5_1; 6.0.0.0 – 6.0.3.1 Vulnerable ·IBM
- cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:o:ibm:i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Oracle
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-4259
- 2026-10-03 Alias added: GHSA-f7gq-m8w9-39fh
References
More IBM Sterling File Gateway vulnerabilities
- TI-2013-03496 XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime… CVSS 2.0HIGH 7.1
- TI-2012-04950 Unspecified vulnerability in the CLA2 server in IBM Gentran Integration Suite 4.3… CVSS 2.0HIGH 9.3
- TI-2020-03955 SQL injection in IBM Sterling File Gateway CVSS 3.1HIGH 8.8
- TI-2014-00854 The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling… CVSS 3.0HIGH 8.1
- TI-2025-12821 IBM Sterling B2B Integrator and IBM Sterling File Gateway Denial of Service CVSS 3.1HIGH 7.5
- TI-2026-06843 SQL injection Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway CVSS 3.1HIGH 8.1
Sources
- CVE-2020-4259 · CVE Program
- CVE-2020-4259 · NVD
- FIRST EPSS
- GHSA-f7gq-m8w9-39fh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences