IBM · Data Risk Manager
CVE-2020-4428
IBM Data Risk Manager Remote Code Execution Vulnerability
Exploited in attacks
Critical 9.1 Attack chance: 62%
What it is
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.
CISA: IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from IBM
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Security Bypass | Data Risk Manager | Critical 9.0 | 70% |
| Nov 3, 2021 | Directory Traversal | Data Risk Manager | Medium 4.3 | 69% |
| Aug 4, 2026 | Code Injection | Langflow | Critical 9.8 | 29% |
| Feb 21, 2023 | Code Execution | Aspera Faspex | Critical 9.8 | >99.9% |
| May 25, 2022 | Invalid Input | InfoSphere BigInsights | Medium 6.5 | 4.8% |
| Jan 10, 2022 | Code Injection. | WebSphere Application Server and Server Hypervisor Edition | Critical 9.8 | 98% |
| Nov 3, 2021 | Remote Code Execution | Planning Analytics | Critical 10.0 | 86% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.