IBM · Data Risk Manager
CVE-2020-4430
IBM Data Risk Manager Directory Traversal Vulnerability
O que é
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535.
CISA: IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system.
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 3 de maio de 2022
Mais falhas exploradas de IBM
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 3 de nov. de 2021 | Security Bypass | Data Risk Manager | Crítica 9,0 | 70% |
| 3 de nov. de 2021 | Remote Code Execution | Data Risk Manager | Crítica 9,1 | 62% |
| 4 de ago. de 2026 | Code Injection | Langflow | Crítica 9,8 | 29% |
| 21 de fev. de 2023 | Code Execution | Aspera Faspex | Crítica 9,8 | >99,9% |
| 25 de mai. de 2022 | Invalid Input | InfoSphere BigInsights | Média 6,5 | 4,8% |
| 10 de jan. de 2022 | Code Injection. | WebSphere Application Server and Server Hypervisor Edition | Crítica 9,8 | 98% |
| 3 de nov. de 2021 | Remote Code Execution | Planning Analytics | Crítica 10,0 | 86% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.