CVE-2020-4494
IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 (Linux), 8.1.9.0 through 8.1.9.1 (AIX) web user interfaces could allow an…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 (Linux), 8.1.9.0 through 8.1.9.1 (AIX) web user interfaces could allow an attacker to bypass authentication due to improper session validation which can result in access to unauthorized resources. IBM X-Force ID: 182019.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.23% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- ibm/spectrum protect client · ibm/spectrum protect for space management
- Source
- psirt@us.ibm.com
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/182019VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6221448Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/182019VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6221448Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.