PT-2020-18052 · Ibm · Ibm Spectrum Protect For Space Management+1

Published 2020-06-15 · Updated 2020-06-18 · CVE-2020-4406

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Client versions 8.1.7.0 through 8.1.9.1 IBM Spectrum Protect for Space Management versions 8.1.7.0 through 8.1.9.1

Description The web user interfaces of the affected software could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this issue to hijack the victim's click actions and possibly launch further attacks against the victim.

Recommendations For IBM Spectrum Protect Client versions 8.1.7.0 through 8.1.9.1, update to a version outside of this range to resolve the issue. For IBM Spectrum Protect for Space Management versions 8.1.7.0 through 8.1.9.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the web user interfaces of the affected software until a patch is available.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2020-4406

Affected Products

Ibm Spectrum Protect Client

Ibm Spectrum Protect For Space Management

References · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/179488 · Vendor Advisory
• https://ibm.com/support/pages/node/6221448 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4406 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4406 · Vendor Advisory
• https://t.me/cvenotify/4366 · Telegram Post