LiveActive security incident?Get immediate response
CVE Record

CVE-2021-20416: IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive in...

IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 196218.

LowCVSS 3.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

IBM Guardium Data Encryption has a low-severity cookie protection issue. Some affected versions did not set the HttpOnly flag, which can make sensitive cookie data easier to access if another weakness is present. This is not a crisis item, but it should be handled in routine security maintenance for exposed GDE deployments.

Executive priority

Treat as low priority unless the affected GDE interface is externally reachable or part of a sensitive administrative environment. It should be remediated through normal patch cycles, with ownership assigned because the product protects sensitive data workflows.

Technical view

CVE-2021-20416 is an information disclosure issue in IBM Guardium Data Encryption caused by missing HttpOnly protection on a cookie. CVSS 3.0 score is 3.7 with network attack vector, high complexity, no privileges, no user interaction, and low confidentiality impact. IBM X-Force tracks it as ID 196218.

Likely exposure

Exposure is limited to organizations running affected IBM Guardium Data Encryption versions. The bundle names 3.0.0.3 and 4.0.0.4 in the description, while its affected list says 3.0.0.2 and 4.0.0.4, so version scope should be verified against IBM guidance.

Exploitation context

The source bundle does not show known active exploitation, and KEV is false. The CVSS vector marks exploit maturity as unproven and attack complexity as high. Missing HttpOnly by itself usually increases risk when paired with another browser-side weakness, but the sources do not document such a chain here.

Researcher notes

Evidence supports information disclosure through missing HttpOnly cookie protection only. Do not assume remote code execution, authentication bypass, or active exploitation. The version discrepancy between the title/description and affected list should be resolved against IBM’s advisory before closing findings.

Mitigation direction

  • Check IBM advisory for the official fixed level or upgrade path.
  • Prioritize remediation on internet-accessible or broadly reachable GDE interfaces.
  • Confirm affected GDE versions in asset inventory and vulnerability tooling.
  • After remediation, verify relevant cookies include the HttpOnly flag.

Validation and detection

  • Identify deployed IBM Guardium Data Encryption versions across environments.
  • Compare installed versions with IBM advisory and X-Force entry.
  • Review HTTP response cookies for missing HttpOnly attributes.
  • Document whether any exposed GDE interfaces remain unpatched.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-20416 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
3.7 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/S:U/AC:H/PR:N/AV:N/A:N/UI:N/I:N/C:L/RL:O/RC:C/E:U

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
3.7CVSS 3.0LowCVSS:3.0/S:U/AC:H/PR:N/AV:N/A:N/UI:N/I:N/C:L/RL:O/RC:C/E:U2.21.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

3.7Low
CVSS 3.0 vector shape for CVE-2021-20416Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/S:U/AC:H/PR:N/AV:N/A:N/UI:N/I:N/C:L/RL:O/RC:C/E:U

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMGuardium Data Encryption3.0.0.2, 4.0.0.4Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.