CVE-2020-4499
First published: Thu Oct 08 2020(Updated: )
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM ISAM | <=9.0.7 | |
| IBM Security Verify Access | <=10.0.0 | |
| IBM Security Access Manager | >=9.0.7.0<9.0.7.2 | |
| IBM Security Verify Access | >=10.0.0<10.0.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-4499.
What is the title of the vulnerability?
The title of the vulnerability is 'IBM Security Access Manager Appliance could allow an unauthorized public Oauth client to bypass some…'
What is the description of the vulnerability?
The vulnerability allows an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications.
What is the affected software?
The affected software includes IBM Security Access Manager version 9.0.7 and IBM Security Verify Access version 10.0.0.
What is the severity of the vulnerability?
The severity of the vulnerability is critical, with a CVSS score of 9.8.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following references: [IBM X-Force ID: 182216](https://exchange.xforce.ibmcloud.com/vulnerabilities/182216) and [IBM Support Page](https://www.ibm.com/support/pages/node/6348046).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/description
- agent/tags
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/ibm
- canonical/ibm security access manager
- version/ibm security access manager/9.0.7.0
- canonical/ibm security verify access
- version/ibm security verify access/10.0.0
- canonical/ibm isam
- version/ibm isam/9.0.7