Vulnerabilities > CVE-2021-39057 - Server-Side Request Forgery (SSRF) vulnerability in IBM Spectrum Protect Plus

CVSS 8.1 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

ibm

CWE-918

NVD

Published: 2021-12-13

Updated: 2021-12-15

Summary

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 214616.

Vulnerable Configurations

Part	Description	Count
Application	Ibm IBM Spectrum Protect Plus 10.1.0 IBM Spectrum Protect Plus 10.1.1 IBM Spectrum Protect Plus 10.1.1.142 IBM Spectrum Protect Plus 10.1.2 IBM Spectrum Protect Plus 10.1.2.209 IBM Spectrum Protect Plus 10.1.2.219 IBM Spectrum Protect Plus 10.1.2.247 IBM Spectrum Protect Plus 10.1.2.271 IBM Spectrum Protect Plus 10.1.2.303 IBM Spectrum Protect Plus 10.1.2.350 IBM Spectrum Protect Plus 10.1.3 IBM Spectrum Protect Plus 10.1.3.236 IBM Spectrum Protect Plus 10.1.3.286 IBM Spectrum Protect Plus 10.1.4 IBM Spectrum Protect Plus 10.1.4.145 IBM Spectrum Protect Plus 10.1.4.179 IBM Spectrum Protect Plus 10.1.4.222 IBM Spectrum Protect Plus 10.1.4.254 IBM Spectrum Protect Plus 10.1.4.277 IBM Spectrum Protect Plus 10.1.5 IBM Spectrum Protect Plus 10.1.5.2130 IBM Spectrum Protect Plus 10.1.5.2153 IBM Spectrum Protect Plus 10.1.5.2181 IBM Spectrum Protect Plus 10.1.5.2199 IBM Spectrum Protect Plus 10.1.6 IBM Spectrum Protect Plus 10.1.7 IBM Spectrum Protect Plus 10.1.8 IBM Spectrum Protect Plus 10.1.8.1	32
OS	Linux Linux Linux Kernel -	1

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References