PT-2020-18174 · Ibm · Ibm Spectrum Protect Plus

Published 2020-08-04 · Updated 2020-08-04 · CVE-2020-4631

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.6

Description The issue concerns access permissions to agent files in non-default configurations on Windows, where these files are assigned full control permissions to everyone. This could allow a local user to interrupt service operations.

Recommendations For IBM Spectrum Protect Plus versions 10.1.0 through 10.1.6, consider restricting access to the agent files to prevent unauthorized modifications and interruptions to service operations. As a temporary workaround, review and adjust the file permissions to ensure they are not accessible to everyone, limiting access to only necessary users or groups.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2020-4631

Affected Products

Ibm Spectrum Protect Plus

References · 4

• https://osv.dev/vulnerability/CVE-2020-4631 · Vendor Advisory
• https://ibm.com/support/pages/node/6255116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4631 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/185372 · Vendor Advisory