Lucene search

IbmCVELIST:CVE-2020-5021

HistoryJan 08, 2021 - 7:10 p.m.

CVE-2020-5021

2021-01-0819:10:25

ibm

www.cve.org

ibm

spectrum protect plus

session invalidation

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C

AI Score

4.5

Confidence

High

EPSS

Percentile

5.1%

JSON

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system. IBM X-Force ID: 193657.

CNA Affected

[
  {
    "product": "Spectrum Protect Plus",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "10.1.0"
      },
      {
        "status": "affected",
        "version": "10.1.6"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/193657

www.ibm.com/support/pages/node/6398754

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C

AI Score

4.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVELIST:CVE-2020-5021