IBM · Data Risk Manager
CVE-2020-4427
IBM Data Risk Manager Security Bypass Vulnerability
What it is
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.
CISA: IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from IBM
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Remote Code Execution | Data Risk Manager | Critical 9.1 | 62% |
| Nov 3, 2021 | Directory Traversal | Data Risk Manager | Medium 4.3 | 69% |
| Aug 4, 2026 | Code Injection | Langflow | Critical 9.8 | 29% |
| Feb 21, 2023 | Code Execution | Aspera Faspex | Critical 9.8 | >99.9% |
| May 25, 2022 | Invalid Input | InfoSphere BigInsights | Medium 6.5 | 4.8% |
| Jan 10, 2022 | Code Injection. | WebSphere Application Server and Server Hypervisor Edition | Critical 9.8 | 98% |
| Nov 3, 2021 | Remote Code Execution | Planning Analytics | Critical 10.0 | 86% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.