Actively exploited in the wild
IBM Data Risk Manager Directory Traversal Vulnerability
IBM - Data Risk Manager · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-4430
MediumCVSS 4.3KEVSummary
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system.
Risk Assessment
An authenticated attacker can access sensitive files, leading to data leakage.
Recommendation
Update IBM Data Risk Manager to the latest patched version.
Other vulnerabilities in IBM Data Risk Manager
See all- CVE-2020-4428CriticalActively exploited
IBM Data Risk Manager versions 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system.
- CVE-2020-4427CriticalActively exploited
IBM Data Risk Manager versions 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could bypass authentication and gain full administrative access.
Original NVD description (English source)
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535.