PT-2021-22369 · Ibm · Ibm Spectrum Protect Plus

Published 2021-12-13 · Updated 2021-12-15 · CVE-2021-39063

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0.0 through 10.1.8.x

Description The issue is related to a misconfiguration in access control headers in the implementation of Cross-Origin Resource Sharing (CORS), which could allow an attacker to perform privileged actions and retrieve sensitive information.

Recommendations For IBM Spectrum Protect Plus versions 10.1.0.0 through 10.1.8.x, consider reconfiguring the access control headers to properly restrict CORS, thereby preventing unauthorized access to sensitive information and privileged actions.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2021-39063

Affected Products

Ibm Spectrum Protect Plus

References · 5

• https://osv.dev/vulnerability/CVE-2021-39063 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39063 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/214956 · Vendor Advisory
• https://ibm.com/support/pages/node/6525346 · Vendor Advisory
• https://t.me/cibsecurity/33885 · Telegram Post