Lucene search

IbmCVELIST:CVE-2021-20432

HistoryApr 26, 2021 - 4:30 p.m.

CVE-2021-20432

2021-04-2616:30:43

ibm

www.cve.org

ibm spectrum protect plus

cross-origin resource sharing

sensitive information

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 196344.

CNA Affected

[
  {
    "product": "Spectrum Protect Plus",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "10.1.0"
      },
      {
        "status": "affected",
        "version": "10.1.7"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/196344

www.ibm.com/support/pages/node/6445733

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

Related for CVELIST:CVE-2021-20432