IBM Spectrum Protect Plus Command Execution Vulnerability (CNVD-2020-20698)

🗓️ 01 Apr 2020 00:00:00Reported by China National Vulnerability DatabaseType

A remote attacker can execute arbitrary commands on IBM Spectrum Protect Plus 10.1.0–10.1.5 via a crafted request.

Reporter	Title	Published	Views	Family All 36
IBM Security Bulletins	Security Bulletin: Authentication Bypass, Arbitrary Directory Deletion, and Command Injection vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-4208, CVE-2020-4214, CVE-2020-4206, CVE-2020-4241, CVE-2020-4242)	1 Apr 202014:49	–	ibm
BDU FSTEC	The vulnerability of the IBM Spectrum Protect Plus data protection software platform, related to insufficient validation of input data, allows attackers to escalate their privileges and execute arbitrary code.	22 Dec 202000:00	–	bdu_fstec
CNVD	IBM Spectrum Protect Plus Command Execution Vulnerability (CNVD-2020-20699)	1 Apr 202000:00	–	cnvd
CNVD	IBM Spectrum Protect Plus Arbitrarily Delete Directory Vulnerability	1 Apr 202000:00	–	cnvd
CNVD	IBM Spectrum Protect Plus Authentication Bypass Vulnerability	1 Apr 202000:00	–	cnvd
CNVD	IBM Spectrum Protect Plus Command Execution Vulnerability	1 Apr 202000:00	–	cnvd
Check Point Advisories	IBM Spectrum Protect Plus Command Injection (CVE-2020-4206)	27 Dec 202000:00	–	checkpoint_advisories
Check Point Advisories	IBM Spectrum Protect Plus uploadHttpsCertificate Command Injection (CVE-2020-4241)	6 Nov 202200:00	–	checkpoint_advisories
CVE	CVE-2020-4206	31 Mar 202014:31	–	cve
CVE	CVE-2020-4208	31 Mar 202014:31	–	cve

Vulners

Node

Source	Link
ibm	www.ibm.com/blogs/psirt/security-bulletin-authentication-bypass-arbitrary-directory-deletion-and-command-injection-vulnerabilities-in-ibm-spectrum-protect-plus-cve-2020-4208-cve-2020-4214-cve-2020-4206-cve-2020-4241/

01 Apr 2020 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 3.19.8

CVSS 29

CVSS 37.5

EPSS0.66298