CVE-2020-4430 in ibm data risk manager
LogPulse has assessed this CVE and a detection rule is being built.
What the vulnerability is
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535.
Affected software: ibm data risk manager
Scores
- CVSS: 4.3 (medium)
- EPSS: 68.54% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2021-11-03
- Published: 2020-05-07
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade IBM Data Risk Manager to 2.0.6 with fix packs 2.0.6.1 and 2.0.6.2
Patch or upgrade. The path traversal that lets an authenticated user download arbitrary files (CVE-2020-4430) affects IDRM 2.0.4 and earlier. IBM fixes it, along with the related IDRM flaws, by upgrading to 2.0.6 and applying fix packs 2.0.6.1 and 2.0.6.2 (APAR GA17223).
Applies to: IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3 and 2.0.4 (path traversal). The related IDRM flaws in the same bulletin affect versions up to 2.0.6.1.
- Log in to the IDRM appliance and check the installed version. Versions 2.0.1 to 2.0.4 are affected.
- Back up the appliance (take a VM snapshot and export the configuration) before you upgrade.
- Download IBM Data Risk Manager 2.0.6 from IBM Passport Advantage (https://www.ibm.com/software/passportadvantage/pacustomers.html) and upgrade the appliance to 2.0.6.
- Apply IDRM_2.0.6.1_Fixpack.
- Apply DRM_2.0.6.2_Fixpack on top of 2.0.6.1. It is not cumulative, so 2.0.6.1 must be installed first.
- Until the upgrade is done, allow only trusted admin networks to reach the IDRM web interface, and change the default administrative account password (CVE-2020-4429). Low-privileged credentials are enough to exploit this flaw.
- Check that the appliance reports version 2.0.6.2, and review the web interface access history for file download requests with ../ sequences.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.