CVE-2020-4945 — Incorrect Permission Assignment in IBM DB2 FOR Linux AND Unix

CWE-732 — Incorrect Permission Assignment4 documents4 sources
Severity
8.1HIGHNVD
EPSS
0.1%
top 68.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM DB2 FOR Linux AND UnixIBM DB2
Timeline
PublishedJun 24
Latest updateMay 24

Description

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to improper group permissions. IBM X-Force ID: 191945.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶NVDibm/db211.5

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-fhg4-xhw8-92hr: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11↗2022-05-24
▶
CVEList
CVE-2020-4945: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11↗2021-06-24
▶
OSV
linux-raspi, linux-raspi-5.4 vulnerabilities↗2021-05-19
▶
CVE-2020-4945 — Incorrect Permission Assignment in IBM | cvebase