Log in Start free

Actively exploited · Published May 7, 2020 · Assigned by ibm

CVE-2020-4430

Medium 4.3 Exploited

In plain English

A medium-severity path traversal in Data Risk Manager from IBM. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 68.5% (higher than 99.3% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.0)4.3Medium
Exploit odds (30 days)68.5%top 0.7% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535.

Affected products (as reported)

VendorProductVersions
IBM Data Risk Manager 2.0.12.0.22.0.32.0.42.0.52.0.6

Weakness: CWE-22 · Vector: CVSS:3.0/S:U/AV:N/A:N/AC:L/C:L/PR:L/UI:N/I:N/E:U/RC:C/RL:O

References