CVE-2020-4470

HIGH

IBM Spectrum Protect Plus < 10.1.5 - Unrestricted File Upload

Title source: rule

Description

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server. IBM X-Force ID: 181725.

References (3)

Core 3

Core References

Patch, Vendor Advisory x_refsource_confirm

https://www.ibm.com/support/pages/node/6221358

VDB Entry, Vendor Advisory vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/181725

Third Party Advisory x_refsource_misc

https://www.tenable.com/security/research/tra-2020-37

Scores

CVSS v3 8.0

EPSS 0.0052

EPSS Percentile 66.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-434

Status published

Products (1)

ibm/spectrum_protect_plus 10.1.0 - 10.1.5

Published Jun 15, 2020

Tracked Since Feb 18, 2026