CVE-2020-4211critical

CVE-2020-4211: critical vulnerability in IBM Spectrum Protect Plus

Published · Updated

Follow this CVE+ Monitor Spectrum Protect Plus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 71%
In short

IBM Spectrum Protect Plus versions 10.1.0 and 10.1.5 contain a flaw that allows attackers to run any code they want on the system by sending a specially crafted HTTP request. This is critical because it gives complete control of the affected server to an attacker.

Technical detail

CVE-2020-4211 is a remote code execution vulnerability in IBM Spectrum Protect Plus 10.1.0 and 10.1.5 exploitable via maliciously crafted HTTP commands without requiring authentication. The vulnerability allows unauthenticated remote attackers to execute arbitrary system commands with the privileges of the application, resulting in complete system compromise.

Summary generated and translated by AI from the official description.
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175022.
CVSS:3.0/A:H/S:U/C:H/UI:N/I:H/AV:N/PR:N/AC:L/RC:C/E:U/RL:O
Affected products
IBM · Spectrum Protect Plus
Related CVEs — IBM Spectrum Protect Plus

In the same product, most dangerous first.

CVE-2020-4241HIGHCVE-2020-4241EPSS 66.3%CVE-2020-4222CRITICALCVE-2020-4222EPSS 15.5%CVE-2020-4213CRITICALCVE-2020-4213EPSS 15.5%CVE-2020-4210CRITICALCVE-2020-4210EPSS 15.5%CVE-2020-4212CRITICALCVE-2020-4212EPSS 15.0%CVE-2020-4469HIGHCVE-2020-4469EPSS 13.4%