Junglewise Threat Intelligence

CVE-2020-4430: IBM Data Risk Manager Directory Traversal Vulnerability

CVE-2020-4430 · Severity: critical · CVSS 4.3 · Exploited in the wild · Published 2021-11-03

Technologies: IBM Data Risk Manager. Vendors: IBM.

Executive brief

IBM Data Risk Manager contains a directory traversal vulnerability where a remote authenticated attacker can send specially crafted URL requests. This allows the attacker to traverse directories and download arbitrary files from the system.

Affected products

  • IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4

Timeline

  • 2020-05-08: disclosed: Initial analysis by NIST and IBM Corporation
  • 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2021-11-03: advisory: NVD publication date

Related threats