PT-2021-5678 · Ibm · Ibm Spectrum Protect Plus File Systems Agent

Published 2021-04-24 · Updated 2021-04-30 · CVE-2021-20536

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

I:N/UI:N/A:N/S:U/AV:L/AC:L/C:H/PR:N

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus File Systems Agent versions 10.1.6 through 10.1.7

Description The issue is related to insufficient protection of registration data, which could allow an attacker to disclose protected information. Specifically, the software stores potentially sensitive information in log files that could be read by a local user.

Recommendations For IBM Spectrum Protect Plus File Systems Agent versions 10.1.6 through 10.1.7, consider restricting access to log files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Uncontrolled Search Path Element

Weakness Enumeration

CWE-532

CWE-427

Related Identifiers

BDU:2022-00117

CVE-2021-20536

Affected Products

Ibm Spectrum Protect Plus File Systems Agent

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-20536 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20536 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00117 · Security Note
• https://ibm.com/support/pages/node/6445739 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/198836 · Vendor Advisory
• https://ibm.com/blogs/psirt/security-bulletin-information-disclosure-in-ibm-spectrum-protect-plus-microsoft-file-systems-backup-and-restore-log-files-cve-2021-20536-2 · Note