CVE-2021-39065

CWE-78 — OS Command Injection CWE-20 — Improper Input Validation3 documents3 sources

Severity

9.8CRITICAL

EPSS

4.2%

top 11.28%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Spectrum Copy Data Management

Timeline

PublishedDec 13

Latest updateDec 14

Description

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the Spectrum Copy Data Management Admin Console login and uploadcertificate function . A remote attacker could inject arbitrary shell commands which would be executed on the affected system. IBM X-Force ID: 214958.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDibm/spectrum_copy_data_management2.2.13

▶CVEListV5ibm/spectrum_copy_data_management2.2.13

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-wvcw-rv39-83m4: IBM Spectrum Copy Data Management 2↗2021-12-14

▶

CVEList

CVE-2021-39065: IBM Spectrum Copy Data Management 2↗2021-12-13

▶