CVE-2020-4739

IBM DB2 Accessories Suite for Linux, UNIX, and Windows, DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could…

High · published November 20, 2020

CVSS v3.0
7.8
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

IBM DB2 Accessories Suite for Linux, UNIX, and Windows, DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 188149.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/PR:N/A:H/AV:L/AC:L/UI:R/S:U/I:H/C:H/RC:C/RL:O/E:U
CVSS v4.0
Not supplied
EPSS
0.00469 · 39.6th percentile
Published
2020-11-20T13:50Z
EPSS history
Timeline
  • 20 NOV 13:50Z
    IBM DB2 Accessories Suite for Linux, UNIX, and Windows, DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could…
    cvelistv5