by Kastro
Paper/Archive/CVE-2020-4427

CVE-2020-4427

IBM Data Risk Manager — IBM Data Risk Manager Security Bypass Vulnerability

KEV · due 3 MayEPSS 70%public exploitSSVC actCVSS 9.0
critical.is priorityof 100
97
CVSS 9.0 (CNA)9.0 / 10 × 3027.0In CISA KEV+3030.0EPSS percentile 99.4.994 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.

Affected

ProductAffectedFixed inSource
Data Risk Manager2.0.1–CNA
Data Risk Manager2.0.2–CNA
Data Risk Manager2.0.3–CNA
Data Risk Manager2.0.4–CNA
Data Risk Manager2.0.5–CNA
Data Risk Manager2.0.6–CNA

Scores by source

ibm (CNA)9.0CVSS:3.0/I:H/UI:N/PR:N/C:H/A:H/AV:N/S:C/AC:H/RL:O/RC:C/E:U
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refibm.com/support/pages/node/6206875refexchange.xforce.ibmcloud.com/vulnerabilities/180532refseclists.org/fulldisclosure/2024/Nov/1refseclists.org/fulldisclosure/2024/Nov/0refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-4427kevcisa.gov/known-exploited-vulnerabilities-catalog