CVE-2020-4427 is a vulnerability in IBM Data Risk Manager

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.

Known Exploited Vulnerability

This IBM Data Risk Manager Authentication Bypass vulnerability is part of CISA's list of Known Exploited Vulnerabilities. IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.

The following remediation steps are recommended / required by May 3, 2022: Apply updates per vendor instructions.

Weakness Type

What is an authentification Vulnerability?

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

CVE-2020-4427 has been classified to as an authentification vulnerability or weakness.

Products Associated with CVE-2020-4427

Want to know whenever a new CVE is published for IBM Data Risk Manager? stack.watch will email you.

Affected Versions

Exploit Probability

EPSS

90.35%

Percentile

99.60%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.