CVE-2020-4987

6.4MEDIUM

Key Information:

Vendor
IBM
Status
Flashsystem 900
Vendor
CVE Published:
4 May 2021

Summary

The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and prior and 1.6.1.2 and prior. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Version(s)

FlashSystem 900 1.6.1.2

FlashSystem 900 1.5.2.8

References

https://www.ibm.com/support/pages/node/6449280
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/192702
vdb-entryx_refsource_XF

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.