VulnerabilityModified
CVE-2020-4415
IBM Spectrum Protect 7.1 and 8.1 server is vulnerable to a stack-based buffer overflow, caused by improper bounds checking.
CRITICAL 9.8EPSS 8.05%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.05%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
IBM Spectrum Protect 7.1 and 8.1 server is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker to execute arbitrary code on the system with the privileges of an administrator or user associated with the Spectrum Protect server or cause the Spectrum Protect server to crash. IBM X-Force ID: 179990.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 8.05% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20, CWE-787
- Affected
- ibm/spectrum protect
- Source
- psirt@us.ibm.com
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179990VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6195706Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179990VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6195706Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.