Remote Code Execution Vulnerability in IBM Spectrum Protect Operations Center
CVE-2020-4955

8HIGH

Key Information:

Vendor
IBM
Status
Spectrum Protect Operations Center
Vendor
CVE Published:
15 February 2021

Summary

IBM Spectrum Protect Operations Center versions 7.1 and 8.1 are vulnerable to a remote code execution flaw due to improper validation of parameters within servlet requests. An attacker can exploit this vulnerability by sending specially crafted input, which could lead to the loading of a malicious .dll file with elevated privileges, allowing for unauthorized actions and system compromise. This vulnerability shows the critical importance of ensuring robust parameter validation to protect the integrity of the system.

Affected Version(s)

Spectrum Protect Operations Center 8.1

Spectrum Protect Operations Center 7.1

Spectrum Protect Operations Center 8.1.10.100

References

https://www.ibm.com/support/pages/node/6404966
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/192155
vdb-entryx_refsource_XF

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.