Lucene search

IbmCVE-2021-20488

HistoryJun 16, 2021 - 5:15 p.m.

CVE-2021-20488

2021-06-1617:15:07

ibm

web.nvd.nist.gov

ibm

security

identity manager

6.0.2

authenticated user

password change

windows ad

x-force id

197789

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

19.6%

JSON

IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM Security Identity Manager Windows Password Synch Plug-in is deployed and configured. IBM X-Force ID: 197789.

Affected configurations

Nvd

Vulners

Node

ibmsecurity_identity_managerMatch6.0.2

AND

ibmaixMatch-

linuxlinux_kernelMatch-

microsoftwindowsMatch-

oraclesolarisMatch--

VendorProductVersionCPE
ibmsecurity_identity_manager6.0.2cpe:2.3:a:ibm:security_identity_manager:6.0.2:*:*:*:*:*:*:*
ibmaix-cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
oraclesolaris-cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:*

Vendor	Product	Version	CPE
ibm	security_identity_manager	6.0.2	cpe:2.3:a:ibm:security_identity_manager:6.0.2:::::::*
ibm	aix	-	cpe:2.3:o:ibm:aix:-:::::::*
linux	linux_kernel	-	cpe:2.3:o:linux:linux_kernel:-:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
oracle	solaris	-	cpe:2.3:o:oracle:solaris:-::::::-:

CNA Affected

[
  {
    "product": "Security Identity Manager",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "6.0.2"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/197789

www.ibm.com/support/pages/node/6464081

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

19.6%

JSON

Related for CVE-2021-20488