CVE-2020-4427
CVE-2020-4427
In short
IBM Data Risk Manager versions 2.0.1 through 2.0.6 have a flaw in their SAML authentication that allows attackers to skip login and gain full admin access by sending a specially crafted HTTP request. This puts all data in the system at risk of being stolen or modified.
Technical detail
The vulnerability is an authentication bypass in SAML-configured instances of IBM Data Risk Manager affecting versions 2.0.1–2.0.6. An unauthenticated remote attacker can craft a malicious HTTP request to circumvent SAML authentication validation, resulting in unauthorized administrative access and full system compromise.
Summary generated and translated by AI from the official description.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.
CVSS:3.0/I:H/UI:N/PR:N/C:H/A:H/AV:N/S:C/AC:H/RL:O/RC:C/E:U
Affected products
IBM · Data Risk ManagerWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →