IBM Spectrum Protect Plus Access Control Error Vulnerability

IBM Spectrum Protect Plus is a data protection platform from IBM USA. The platform provides enterprises with a single point of control and management, and supports backup and recovery for virtual, physical and cloud environments of all sizes.A security vulnerability exists in IBM Spectrum Protect...

CVE-2021-39063

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information due to a misconfiguration in access control headers. IBM X-Force ID: 214956...

CVE-2021-39057

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 214616...

CVE-2021-39063

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information due to a misconfiguration in access control headers. IBM X-Force ID: 214956...

CVE-2020-4496

The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046...

CVE-2020-4496

The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046...

Server side request forgery (ssrf)

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 214616...

Design/Logic Flaw

The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information due to a misconfiguration in access control headers. IBM X-Force ID: 214956...

CVE-2021-39063

CVE-2021-39063 affects IBM Spectrum Protect Plus 10.1.0.0–10.1.8.x. A misconfiguration in Cross-Origin Resource Sharing (CORS) headers can allow an attacker to perform privileged actions and disclose sensitive information. The incident is corroborated by multiple sources (NVD entry for CVSS 3.1 b...

CVE-2021-39057

IBM Spectrum Protect Plus (10.1.0.0–10.1.8.x) is affected by a server‑side request forgery (SSRF) vulnerability due to insufficient input filtering/validation on the server. An authenticated attacker could send unauthorized requests from the vulnerable system, enabling network enumeration and fac...

CVE-2021-39057

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 214616...

CVE-2020-4496

IBM Spectrum Protect Plus (IBM Spectrum Protect Plus server connected to a workload agent) is affected by CVE-2020-4496: MITM due to improper certificate validation in versions 10.1.0.0–10.1.8.x. The IBM security bulletin lists a fix in Spectrum Protect Plus 10.1.9 (Linux) and notes remediation/w...

CVE-2020-4496

The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046...

CVE-2020-4496: Improper Certificate Validation

The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046...

CVE-2021-39063: Origin Validation Error

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information due to a misconfiguration in access control headers. IBM X-Force ID: 214956...

PT-2021-22366

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0.0 through 10.1.8.x Description The issue allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This i...

PT-2021-12125

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Protect Plus versions 10.1.0.0 through 10.1.8.x Description: The server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. Recommendations: F...

CVE-2021-39057: Server-Side Request Forgery (SSRF)

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 214616...

PT-2021-22369

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0.0 through 10.1.8.x Description The issue is related to a misconfiguration in access control headers in the implementation of Cross-Origin Resource Sharing CORS, which could allow an attacker to perform...