PT-2022-9038 · Ibm · Ibm Spectrum Protect Plus

Published 2022-12-14 · Updated 2022-12-20 · CVE-2020-4497

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.12

Description The issue discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum Protect Plus vSnap and its agents. An attacker could obtain information using man-in-the-middle techniques.

Recommendations For versions 10.1.0 through 10.1.12, consider implementing encryption for the communication flow between Spectrum Protect Plus vSnap and its agents to prevent sensitive information disclosure. As a temporary workaround, restrict access to the communication flow to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-4497

Affected Products

Ibm Spectrum Protect Plus

References · 4

• https://osv.dev/vulnerability/CVE-2020-4497 · Vendor Advisory
• https://ibm.com/support/pages/node/6847627 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4497 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/182106 · Vendor Advisory