CVE-2021-20488

CWE-668 — Exposure to Wrong Sphere3 documents3 sources

Severity

6.5MEDIUM

EPSS

0.2%

top 58.86%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Security Identity Manager

Timeline

PublishedJun 16

Latest updateMay 24

Description

IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM Security Identity Manager Windows Password Synch Plug-in is deployed and configured. IBM X-Force ID: 197789.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ibm/security_identity_manager6.0.2

▶NVDibm/security_identity_manager6.0.2

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-x6hg-qh4q-23x7: IBM Security Identity Manager 6↗2022-05-24

▶

CVEList

CVE-2021-20488: IBM Security Identity Manager 6↗2021-06-16

▶