IBM Connect:direct vulnerabilities

2 CVEs affecting IBM Connect:direct, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4747, published 2020-12-15.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-4747, published 2020-12-15. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. IBM Connect:Direct for UNIX 6.1.0, 6.0.0, 4.3.0, and 4.2.0 can allow a local or remote user to obtain an authenticated CLI session due to improper authentication methods. IBM X-Force ID: 188516.
• CVE-2020-4587, published 2020-08-24. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, 6.0.0, and 6.1.0 is vulnerable to a stack based buffer ovreflow, caused by improper bounds checking. A local attacker could manipulate CD UNIX to…