CVE-2020-4470

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server. IBM X-Force ID: 181725.

Affected

IBM · Spectrum Protect Plus

CVSS v3.1 NVD

8.0 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CVSS v3.0 IBM

7.1 HIGHCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

EPSS

1.91% chance of exploitation in the next 30 days, 80th percentile

Published

2020-06-15

Updated

2024-09-16

Exploit collections (1)

• ibm/spectrum_protect/ibm_spp_file_upload_rce_CVE-2020-4470.pytenable/poc

Security advisories

• https://exchange.xforce.ibmcloud.com/vulnerabilities/181725
• https://www.ibm.com/support/pages/node/6221358
• https://www.tenable.com/security/research/tra-2020-37

References

• CVE Record
• NVD entry