CVE-2020-4348 — Missing Authorization in IBM Spectrum Scale

CWE-862 — Missing AuthorizationCWE-863 — Incorrect Authorization3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 71.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Spectrum Scale
Timeline
PublishedMay 27
Latest updateMay 24

Description

IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized actions due to missing function level access control. IBM X-Force ID: 178414

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDibm/spectrum_scale4.2.0.0 — 4.2.3.21+1
▶CVEListV5ibm/spectrum_scale4 versions+3

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-8gpv-8v95-g9v9: IBM Spectrum Scale 4↗2022-05-24
▶
CVEList
CVE-2020-4348: IBM Spectrum Scale 4↗2020-05-27
▶
CVE-2020-4348 — Missing Authorization in IBM | cvebase