Remote Code Execution Vulnerability in IBM Spectrum Protect Operations Center
CVE-2020-4955
8HIGH
Key Information:
- Vendor
- IBM
- Vendor
- CVE Published:
- 15 February 2021
Summary
IBM Spectrum Protect Operations Center versions 7.1 and 8.1 are vulnerable to a remote code execution flaw due to improper validation of parameters within servlet requests. An attacker can exploit this vulnerability by sending specially crafted input, which could lead to the loading of a malicious .dll file with elevated privileges, allowing for unauthorized actions and system compromise. This vulnerability shows the critical importance of ensuring robust parameter validation to protect the integrity of the system.
Affected Version(s)
Spectrum Protect Operations Center 8.1
Spectrum Protect Operations Center 7.1
Spectrum Protect Operations Center 8.1.10.100
References
CVSS V3.1
Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved