LiveActive security incident?Get immediate response
CVE Record

CVE-2021-29749: IBM Secure External Authentication Server 6.0.2 and IBM Secure Proxy 6.0.2 is vulnerable to server-side req...

IBM Secure External Authentication Server 6.0.2 and IBM Secure Proxy 6.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 201777.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw lets an attacker make affected IBM systems send unintended requests from inside the network. That can reveal internal network information or support other attacks. The known affected versions are IBM Secure Proxy 6.0.2 and IBM Secure External Authentication Server 6.0.2.

Executive priority

Treat this as a moderate-priority exposure issue. It is not marked as known exploited here, but SSRF in perimeter or authentication infrastructure can help attackers map internal systems.

Technical view

CVE-2021-29749 is an SSRF issue in IBM Secure Proxy 6.0.2 and Secure External Authentication Server 6.0.2. The record cites potential unauthorized requests, network enumeration, and follow-on attacks. CVSS is 6.5. The description says authenticated attacker, while the vector lists PR:N, so prerequisites need vendor clarification.

Likely exposure

Exposure is limited to environments running the named IBM products at version 6.0.2. Risk is higher where these services can reach sensitive internal networks or are reachable by untrusted users.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation evidence. IBM X-Force tracks the issue as ID 201777. Public evidence here supports potential SSRF impact, not confirmed exploitation in the wild.

Researcher notes

Focus validation on exact product/version matching and reachable internal network scope. The source bundle lacks exploit details and named fixed versions. Note the attacker-authentication inconsistency between the narrative description and CVSS vector.

Mitigation direction

  • Check IBM advisories for fixed levels or vendor-approved mitigation guidance.
  • Inventory IBM Secure Proxy and Secure External Authentication Server versions.
  • Prioritize remediation for internet-reachable or broadly accessible deployments.
  • Restrict service access to trusted networks while vendor guidance is reviewed.
  • Do not assume other IBM products are affected without vendor confirmation.

Validation and detection

  • Confirm whether IBM Secure Proxy 6.0.2 is deployed.
  • Confirm whether Secure External Authentication Server 6.0.2 is deployed.
  • Review network paths these systems can reach internally.
  • Check access controls for users who can interact with affected services.
  • Verify remediation status against IBM advisory guidance.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Cloud metadata behavior lookup

The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-29749 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/S:U/AV:N/PR:N/UI:N/AC:L/A:N/C:L/I:L/E:U/RC:C/RL:O

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.0MediumCVSS:3.0/S:U/AV:N/PR:N/UI:N/AC:L/A:N/C:L/I:L/E:U/RC:C/RL:O3.92.5Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

6.5Medium
CVSS 3.0 vector shape for CVE-2021-29749Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/S:U/AV:N/PR:N/UI:N/AC:L/A:N/C:L/I:L/E:U/RC:C/RL:O

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMSecure Proxy6.0.2Listed
IBMSecure External Authentication Server6.0.2Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.