VulnerabilityModified
CVE-2020-4202
IBM UrbanCode Deploy (UCD) 7.0.3.0 and 7.0.4.0 could allow an authenticated user to impersonate another user if the server is configured to enable Distributed Front End (DFE).
HIGH 8.8EPSS 0.97%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.97%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
IBM UrbanCode Deploy (UCD) 7.0.3.0 and 7.0.4.0 could allow an authenticated user to impersonate another user if the server is configured to enable Distributed Front End (DFE). IBM X-Force ID: 174955.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.97% probability · 60th percentile
- CISA KEV
- Not listed
- Affected
- ibm/urbancode deploy
- Source
- psirt@us.ibm.com
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/174955VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6195701Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/174955VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6195701Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.