CVE-2020-4210: IBM Spectrum Protect Plus changeAdministratorPassword Command Injection Remote Code Execution Vulnerability
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175020.
Other sources
IBM Spectrum Protect Plus could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2020-4210.
What is the title of this vulnerability?
The title of this vulnerability is IBM Spectrum Protect Plus changeAdministratorPassword Command Injection Remote Code Execution Vulnerability.
What is the severity of CVE-2020-4210?
CVE-2020-4210 has a severity of critical.
Is authentication required to exploit CVE-2020-4210?
No, authentication is not required to exploit CVE-2020-4210.
What software is affected by CVE-2020-4210?
IBM Spectrum Protect Plus versions 10.1.0 to 10.1.5 are affected by CVE-2020-4210.
How can I fix CVE-2020-4210?
To fix CVE-2020-4210, it is recommended to update to a version of IBM Spectrum Protect Plus that is not affected by the vulnerability.
Where can I find more information about CVE-2020-4210?
You can find more information about CVE-2020-4210 at the following references: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/175020), [IBM Support](https://www.ibm.com/support/pages/node/3178863), [Zero Day Initiative](https://www.zerodayinitiative.com/advisories/ZDI-20-274/).
What is the CWE category of CVE-2020-4210?
CVE-2020-4210 belongs to the CWE category 78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').