CVE-2020-4477 — Log File Information Exposure in IBM Spectrum Protect Plus

CWE-532 — Log File Information ExposureCWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 52.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Spectrum Protect Plus
Timeline
PublishedJun 15
Latest updateMay 24

Description

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the system. IBM X-Force ID: 181779.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDibm/spectrum_protect_plus10.1.0 — 10.1.5
▶CVEListV5ibm/spectrum_protect_plus10.1.0, 10.1.5+1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-x58q-f52q-jq52: IBM Spectrum Protect Plus 10↗2022-05-24
▶
CVEList
CVE-2020-4477: IBM Spectrum Protect Plus 10↗2020-06-15
▶
CVE-2020-4477 — Log File Information Exposure in IBM | cvebase