CVE-2021-20538 — Incorrect Authorization in IBM Cloud PAK FOR Security

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
9.1CRITICALNVD
EPSS
0.1%
top 67.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Cloud PAK FOR Security
Timeline
PublishedMay 10
Latest updateMay 24

Description

IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect authorization mechanisms. IBM X-Force ID: 198919.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5ibm/cloud_pak_for_security1.5.0.0, 1.5.0.1+1
▶NVDibm/cloud_pak1.5.0.0, 1.5.0.1+1

🔴Vulnerability Details

2
GHSA
GHSA-r4xw-2898-q2r3: IBM Cloud Pak for Security (CP4S) 1↗2022-05-24
▶
CVEList
CVE-2021-20538: IBM Cloud Pak for Security (CP4S) 1↗2021-05-10
▶
CVE-2021-20538 — Incorrect Authorization in IBM | cvebase