PT-2021-13962 · Ibm · Ibm Spectrum Protect Plus

Published 2021-04-26 · Updated 2021-04-30 · CVE-2021-20432

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Protect Plus versions 10.1.0 through 10.1.7

Description: The issue allows an attacker to perform privileged actions and retrieve sensitive information due to the use of Cross-Origin Resource Sharing (CORS) without limiting the domain name to trusted domains.

Recommendations: For IBM Spectrum Protect Plus versions 10.1.0 through 10.1.7, restrict access to trusted domains to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-20432

Affected Products

Ibm Spectrum Protect Plus

References · 4

• https://osv.dev/vulnerability/CVE-2021-20432 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/196344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20432 · Security Note
• https://ibm.com/support/pages/node/6445733 · Vendor Advisory