PT-2021-12125 · Ibm · Ibm Spectrum Protect Plus

Published 2021-12-13 · Updated 2021-12-15 · CVE-2020-4496

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

C:H/I:N/UI:N/AV:N/AC:H/S:C/PR:N/A:N

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Protect Plus versions 10.1.0.0 through 10.1.8.x

Description: The server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation.

Recommendations: For versions 10.1.0.0 through 10.1.8.x, consider implementing proper certificate validation to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to the server connection to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-4496

Affected Products

Ibm Spectrum Protect Plus

References · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/182046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4496 · Security Note
• https://ibm.com/support/pages/node/6525346 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4496 · Vendor Advisory
• https://t.me/cibsecurity/33880 · Telegram Post