PT-2022-10866 · Ibm · Ibm Spectrum Copy Data Management

Published 2022-03-14 · Updated 2022-03-22 · CVE-2021-39051

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Spectrum Copy Data Management versions 2.2.0.0 through 2.2.14.3

Description The issue is caused by improper input of the application server registration function, leading to server-side request forgery. A remote attacker could exploit this using the host address and port fields of the application server registration form in the portal UI to enumerate and attack services running on those hosts.

Recommendations For versions 2.2.0.0 through 2.2.14.3, update to a version that fixes the improper input of the application server registration function to prevent server-side request forgery. As a temporary workaround, consider restricting access to the application server registration form in the portal UI to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-39051

Affected Products

Ibm Spectrum Copy Data Management

References · 5

• https://ibm.com/support/pages/node/6562479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39051 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39051 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/214441 · Vendor Advisory
• https://t.me/cibsecurity/38888 · Telegram Post