Lucene search

IbmCVE-2021-20432

HistoryApr 26, 2021 - 5:15 p.m.

CVE-2021-20432

2021-04-2617:15:07

ibm

web.nvd.nist.gov

ibm spectrum protect plus

cors

cross-origin resource sharing

information security

vulnerability

cve-2021-20432

ibm x-force id 196344

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 196344.

Affected configurations

Nvd

Vulners

Node

linuxlinux_kernelMatch-

AND

ibmspectrum_protect_plusRange10.1.0–10.1.7

VendorProductVersionCPE
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
ibmspectrum_protect_plus*cpe:2.3:a:ibm:spectrum_protect_plus:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	-	cpe:2.3:o:linux:linux_kernel:-:::::::*
ibm	spectrum_protect_plus	*	cpe:2.3:a:ibm:spectrum_protect_plus::::::::

CNA Affected

[
  {
    "product": "Spectrum Protect Plus",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "10.1.0"
      },
      {
        "status": "affected",
        "version": "10.1.7"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/196344

www.ibm.com/support/pages/node/6445733

Social References

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

Related for CVE-2021-20432