CVE-2020-4461

CWE-20 — Improper Input ValidationCWE-194 documents4 sources
Severity
6.5MEDIUM
EPSS
0.2%
top 61.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Security Access ManagerIBM Security Access Manager Appliance
Timeline
PublishedMay 20
Latest updateMay 24

Description

IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing id_token claims manipulation without verification. IBM X-Force ID: 181481.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDibm/security_access_manager9.0 — 9.0.7.1

🔴Vulnerability Details

2
GHSA
GHSA-q52p-r4p7-72q3: IBM Security Access Manager Appliance 9↗2022-05-24
▶
CVEList
CVE-2020-4461: IBM Security Access Manager Appliance 9↗2020-05-20
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE Software for Cisco 4461 Integrated Services Routers Denial of Service Vulnerability↗2020-09-24
▶
CVE-2020-4461 (MEDIUM CVSS 6.5) | IBM Security Access Manager Applian | cvebase.io