CVE-2020-4620

IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation of file extensions

High · published September 22, 2020

CVSS v3.0
8.8
EPSS
5%
Percentile
92.4
In the wild
Unconfirmed
What it is

IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially-crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious file, which could allow the attacker to execute arbitrary code on the vulnerable system. IBM X-Force ID: 184979.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/I:H/UI:N/A:H/PR:L/S:U/AV:N/AC:L/C:H/E:U/RC:C/RL:O
CVSS v4.0
Not supplied
EPSS
0.05187 · 92.4th percentile
Published
2020-09-22T13:55Z
EPSS history
Timeline
  • 22 SEP 13:55Z
    IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation of file extensions
    cvelistv5