CVE-2020-5021: IBM Spectrum Protect Plus

Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days.

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system. IBM X-Force ID: 193657.

Affected products

• IBM Spectrum Protect Plus: from 10.1.0, before 10.1.7 (fixed in 10.1.7)

Published 2021-01-08. Last modified 2026-06-17.