Actively exploited · Published May 7, 2020 · Assigned by ibm
CVE-2020-4428
Critical 9.1 Exploited
In plain English
A critical-severity OS command injection in Data Risk Manager from IBM. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 61.7% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | Data Risk Manager | 2.0.12.0.22.0.32.0.42.0.52.0.6 |
Weakness: CWE-78 · Vector: CVSS:3.0/AC:L/AV:N/S:C/A:H/C:H/PR:H/UI:N/I:H/E:U/RL:O/RC:C
References
- https://www.ibm.com/support/pages/node/6206875 x_refsource_CONFIRM
- ibm-drm-cve20204428-command-exec (180533) vdb-entry, x_refsource_XF
- http://seclists.org/fulldisclosure/2024/Nov/1
- http://seclists.org/fulldisclosure/2024/Nov/0
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-4428 government-resource