PT-2021-2356 · Ibm · Ibm Application Performance Management+1

Published 2021-02-26 · Updated 2021-03-08 · CVE-2020-4725

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Monitoring versions 8.1.4

Description The issue exists due to inadequate protection of the web page structure in IBM Application Performance Management (APM). An attacker, acting remotely, can exploit this to impact data integrity by sending a specially crafted HTTP request. This could allow an authenticated user to modify HTML content, potentially misleading another user.

Recommendations For version 8.1.4, consider restricting access to the APM UI to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the APM UI for sensitive operations until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-01594

CVE-2020-4725

Affected Products

Ibm Application Performance Management

Ibm Monitoring

References · 10

• https://osv.dev/vulnerability/CVE-2020-4725 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/187974 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01594 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-4725 · Security Note
• https://ibm.com/support/pages/node/6417137 · Vendor Advisory
• https://cxsecurity.com/cveshow/CVE-2020-4725 · Note
• https://t.me/cvenotify/11008 · Telegram Post
• https://t.me/cibsecurity/24350 · Telegram Post
• https://t.me/cvenotify/10735 · Telegram Post
• https://vuldb.com/?id.170580 · Note