Vulnerabilities > CVE-2020-4783 - Missing Authorization vulnerability in IBM Spectrum Protect Plus

CVSS 5.9 - MEDIUM

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

high complexity

ibm

CWE-862

NVD

Published: 2020-11-23

Updated: 2021-07-21

Summary

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 189214.

Vulnerable Configurations

Part	Description	Count
Application	Ibm IBM Spectrum Protect Plus 10.1.0 IBM Spectrum Protect Plus 10.1.1 IBM Spectrum Protect Plus 10.1.1.142 IBM Spectrum Protect Plus 10.1.2 IBM Spectrum Protect Plus 10.1.2.209 IBM Spectrum Protect Plus 10.1.2.219 IBM Spectrum Protect Plus 10.1.2.247 IBM Spectrum Protect Plus 10.1.2.271 IBM Spectrum Protect Plus 10.1.2.303 IBM Spectrum Protect Plus 10.1.2.350 IBM Spectrum Protect Plus 10.1.3 IBM Spectrum Protect Plus 10.1.3.236 IBM Spectrum Protect Plus 10.1.3.286 IBM Spectrum Protect Plus 10.1.4 IBM Spectrum Protect Plus 10.1.4.145 IBM Spectrum Protect Plus 10.1.4.179 IBM Spectrum Protect Plus 10.1.4.222 IBM Spectrum Protect Plus 10.1.4.254 IBM Spectrum Protect Plus 10.1.4.277 IBM Spectrum Protect Plus 10.1.5 IBM Spectrum Protect Plus 10.1.5.2130 IBM Spectrum Protect Plus 10.1.5.2153 IBM Spectrum Protect Plus 10.1.5.2181 IBM Spectrum Protect Plus 10.1.5.2199 IBM Spectrum Protect Plus 10.1.6	29
OS	Linux Linux Linux Kernel -	1

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References