IBM · Data Risk Manager
CVE-2020-4427
IBM Data Risk Manager Security Bypass Vulnerability
Nedir
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.
CISA: IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 3 Mayıs 2022
IBM için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 3 Kas 2021 | Remote Code Execution | Data Risk Manager | Kritik 9,1 | 62% |
| 3 Kas 2021 | Directory Traversal | Data Risk Manager | Orta 4,3 | 69% |
| 4 Ağu 2026 | Code Injection | Langflow | Kritik 9,8 | 29% |
| 21 Şub 2023 | Code Execution | Aspera Faspex | Kritik 9,8 | >99,9% |
| 25 May 2022 | Invalid Input | InfoSphere BigInsights | Orta 6,5 | 4,8% |
| 10 Oca 2022 | Code Injection. | WebSphere Application Server and Server Hypervisor Edition | Kritik 9,8 | 98% |
| 3 Kas 2021 | Remote Code Execution | Planning Analytics | Kritik 10,0 | 86% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.