IBM Data Risk Manager vulnerabilities

18 CVEs affecting IBM Data Risk Manager, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-38915, published 2021-10-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4427: IBM Data Risk Manager Security Bypass Vulnerability, published 2020-05-07. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 70% chance of exploitation in the next 30 days. IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially…
CVE-2020-4430: IBM Data Risk Manager Directory Traversal Vulnerability, published 2020-05-07. Medium severity, CVSS 4.3. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 68.5% chance of exploitation in the next 30 days. IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to…
CVE-2020-4428: IBM Data Risk Manager Remote Code Execution Vulnerability, published 2020-05-07. Critical severity, CVSS 9.1. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 61.7% chance of exploitation in the next 30 days. IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.
CVE-2020-4429, published 2020-05-07. Critical severity, CVSS 9.8. EPSS: 72% chance of exploitation in the next 30 days. IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and…
CVE-2020-4620, published 2020-09-22. High severity, CVSS 8.8. EPSS: 5.2% chance of exploitation in the next 30 days. IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially-crafted HTTP…
CVE-2020-4616, published 2020-09-22. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Data Risk Manager (iDNA) 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 184929.
CVE-2020-4611, published 2020-09-22. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to bypass security and execute actions reserved for admins. IBM X-Force ID: 184922.
CVE-2020-4621, published 2020-09-22. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient authorization checks. IBM X-Force ID: 184981.
CVE-2020-4612, published 2020-09-22. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to obtain sensitive information using a specially crafted HTTP request. IBM X-Force ID: 184924.
CVE-2020-4622, published 2020-09-22. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Data Risk Manager (iDNA) 2.0.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external…

Latest

CVE-2021-38915, published 2021-10-12. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Data Risk Manager 2.0.6 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 209947.
CVE-2021-38862, published 2021-10-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207980.
CVE-2020-4619, published 2020-09-22. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Data Risk Manager (iDNA) 2.0.6 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 184976.
CVE-2020-4618, published 2020-09-22. Medium severity, CVSS 4.9. EPSS: 1.1% chance of exploitation in the next 30 days. IBM Data Risk Manager (iDNA) 2.0.6 could allow a privileged user to cause a denial of service due to improper input validation. IBM X-Force ID: 184937.
CVE-2020-4617, published 2020-09-22. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website…
CVE-2020-4615, published 2020-09-22. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…