CVE-2020-4430mediumunder attackCWE-22

CVE-2020-4430: medium-severity vulnerability in IBM Data Risk Manager

Published · Updated

Follow this CVE+ Monitor Data Risk Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

55Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 4.3epss 69%
from disclosure to weapon
Published on NVDMay 7
CISA KEV+545d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

IBM Data Risk Manager allows authenticated users to download any file from the server by crafting special URLs that bypass directory restrictions. This lets attackers access sensitive files they shouldn't be able to reach.

Technical detail

Path traversal vulnerability in IBM Data Risk Manager 2.0.1-2.0.4 allows authenticated attackers to bypass directory restrictions and download arbitrary files via specially-crafted URL requests. Attack requires valid authentication credentials; impact includes unauthorized access to sensitive system files.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535.
CVSS:3.0/S:U/AV:N/A:N/AC:L/C:L/PR:L/UI:N/I:N/E:U/RC:C/RL:O
Affected products
IBM · Data Risk Manager
Related CVEs — IBM Data Risk Manager

In the same product, most dangerous first.

CVE-2020-4427CRITICALCVE-2020-4427EPSS 70.0%KEVCVE-2020-4428CRITICALCVE-2020-4428EPSS 61.7%KEVCVE-2020-4429CRITICALCVE-2020-4429EPSS 72.0%CVE-2020-4620HIGHCVE-2020-4620EPSS 5.2%CVE-2020-4616MEDIUMCVE-2020-4616EPSS 1.7%CVE-2020-4611HIGHCVE-2020-4611EPSS 1.6%