CVE-2020-4242

IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary…

High8.8EPSS 4.6%

Published: 31 Mar 2020
Updated: 16 Sept 2024
Reserved: 30 Dec 2019
Assigned by: ibm

Description

IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 175419.

Timeline

2019
30 Dec 2019
30 Dec 2019
ID reserved
By ibm
2020
31 Mar 20203 months later
31 Mar 2020· 3 months later
Published
2024
16 Sept 20244 years later
16 Sept 2024· 4 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-4242, by who scored it
Scored by	CVSS	Score	Vector
ibmCNA (assigner)	3.0	High8.8	CVSS:3.0/A:H/AV:N/PR:L/AC:L/C:H/UI:N/I:H/S:U/RL:O/RC:C/E:U
NVDNVD · Modified	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 4.6% · top 8.3% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

Gain Privileges
CWE-78 (opens in a new tab)All about CWE-78 and its CVEs

Affected products

IBM · Spectrum Protect Plus
- affected 10.1.0
- affected 10.1.5

References (2)

https://www.ibm.com/support/pages/node/6114130 (opens in a new tab)x_refsource_CONFIRMx_transferred
ibm-spectrum-cve20204242-command-injection (175419) (opens in a new tab)vdb-entryx_refsource_XFx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-4242](https://trackcve.app/badge/CVE-2020-4242.svg)](https://trackcve.app/cve/CVE-2020-4242)

Record last updated 16 Sept 2024, 20:58 UTC.