IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials whic…

Published 6 y ago 2020-05-28 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.3

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.1%

percentile 66%

Public exploits

none known

IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which could be used to attempt further attacks against the system. IBM X-Force ID: 175336.

Exploit prediction (EPSS)

1.13% probability of exploitation in the next 30 days, higher than 66% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	5.3	`CVSS:3.0/PR:N/UI:N/A:N/AC:L/AV:N/C:L/S:U/I:N/E:U/RL:O/RC:C`
NVD	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
CNA	3.0	5.3	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`

Affected products

IBM Security Identity Governance and Intelligence

Classification

Weakness

CWE-307 Improper Restriction of Excessive Authentication Attempts

References

ibm.com /support/pages/node/6207906 · x_refsource_CONFIRM, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/175336 · vdb-entry, x_refsource_XF, x_transferred

Sources

CVE List: CVE-2020-4232
NVD: CVE-2020-4232

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.