The vulnerability of the application for identifying, analyzing, and visualizing business risks in IBM Data Risk Manager stems from deficiencies in checking the path name to the restricted access catalog. This allows attackers to write arbitrary files.

🗓️ 18 Nov 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

IBM Data Risk Manager path traversal flaw allows remote upload of arbitrary files via crafted web address.

Reporter	Title	Published	Views	Family All 21
IBM Security Bulletins	Security Bulletin: Vulnerabilities exist in IBM Data Risk Manager (CVE-2020-4427, CVE-2020-4428, CVE-2020-4429, and CVE-2020-4430)	28 May 202005:43	–	ibm
ATTACKERKB	CVE-2020-4430	21 Apr 202000:00	–	attackerkb
Circl	CVE-2020-4430	8 Nov 202108:58	–	circl
CISA KEV Catalog	IBM Data Risk Manager Directory Traversal Vulnerability	3 Nov 202100:00	–	cisa_kev
CNVD	IBM Data Risk Manager Path Traversal Vulnerability	8 May 202000:00	–	cnvd
Check Point Advisories	IBM Data Risk Manager Arbitrary File Download (CVE-2020-4430)	9 Jan 202200:00	–	checkpoint_advisories
CVE	CVE-2020-4430	7 May 202019:20	–	cve
Cvelist	CVE-2020-4430	7 May 202019:20	–	cvelist
Tenable Nessus	IBM Data Risk Manager 2.0.1 <= 2.0.4 Multiple Vulnerabilities (6206875)	14 Sep 202300:00	–	nessus
Metasploit	IBM Data Risk Manager Arbitrary File Download	21 Apr 202008:53	–	metasploit

Vulners

Node

ibm ibm_data_risk_managerRange2.0.1–2.0.6

Source	Link
cxsecurity	www.cxsecurity.com/cveshow/CVE-2020-4430/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-4430
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/180535
ibm	www.ibm.com/support/pages/node/6206875
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 24

CVSS 34.3

EPSS0.68544

data risk manager path traversal remote attack arbitrary files crafted web address