Lucene search

IBM4689229757FEEE3157DB50BBAA82DD9376C6E8034EFA62377E0F8FD1D5AAF35A

HistoryMar 15, 2021 - 6:41 a.m.

Security Bulletin: IBM Security Privileged Identity Manager is affected by a code execution vulnerability (CVE-2020-4448)

2021-03-1506:41:25

www.ibm.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

JSON

Summary

IBM Security Privileged Identity Manager has addressed a remote code execution vulnerability in WebSphere Application Server ND.

Vulnerability Details

CVEID:CVE-2020-4448
**DESCRIPTION:**IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 181228.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/181228 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
ISPIM	2.1.1
ISPIM	2.0.2
ISPIM	2.1.0

Remediation/Fixes

Affected Product(s)	Version(s)	Remediation
ISPIM	2.1.1	2.1.1-ISS-ISPIM-VA-FP0006

ISPIM	2.1.0	2.1.0-ISS-ISPIM-VA-FP0013
ISPIM	2.0.2	2.0.2-ISS-ISPIM-VA-FP0013
—	—	—

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm security privileged identity managereq2.1.1
ibm security privileged identity managereq2.1.0
ibm security privileged identity managereq2.0.2

Name	Operator	Version
ibm security privileged identity manager	eq	2.1.1
ibm security privileged identity manager	eq	2.1.0
ibm security privileged identity manager	eq	2.0.2

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

JSON

Related for 4689229757FEEE3157DB50BBAA82DD9376C6E8034EFA62377E0F8FD1D5AAF35A