PT-2020-18061 · Ibm · Websphere Application Liberty

Published 2020-05-06 · Updated 2021-07-21 · CVE-2020-4421

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Liberty versions 19.0.0.5 through 20.0.0.4

Description The issue allows an authenticated user using openidconnect to spoof another user's identity.

Recommendations For versions 19.0.0.5 through 20.0.0.4, consider disabling the openidconnect feature until a patch is available to prevent user identity spoofing.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2020-4421

Affected Products

Websphere Application Liberty

References · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/180084 · Vendor Advisory
• https://ibm.com/support/pages/node/6205926 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4421 · Security Note
• https://t.me/cvenotify/3578 · Telegram Post