CVE-2020-4693

Vulnerability

IBM Spectrum Protect Operations Center versions 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 are affected by a code injection vulnerability [1]. The issue stems from improper validation of data prior to export, which can be leveraged to execute arbitrary code on the system [1].

Exploitation

An attacker can exploit this vulnerability over the network without needing any authentication or user interaction [1]. The CVSS vector indicates the attack complexity is low and no privileges are required [1]. The exact steps are not disclosed in the available references, but the vulnerability is remotely exploitable via network access.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the system [1]. The CVSSv3 base score of 9.1 reflects high impact to both confidentiality and integrity, though availability is not affected [1]. The attacker can gain full control over system data and operations.

Mitigation

IBM has not yet released a fix for this vulnerability as of the initial publication date; the advisory states "Workarounds and Mitigations: None" [1]. Users are advised to monitor IBM's support page for future updates and apply patches when available.