CVE-2021-39064

Vulnerability

IBM Spectrum Copy Data Management versions 2.2.13 and earlier have weak authentication and password rules, and incorrectly handle default credentials for the admin console [1]. The product uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information [1].

Exploitation

An attacker with network access to the admin console can exploit the weak authentication mechanisms and default credentials to gain unauthorized access [1]. The vulnerability is remotely exploitable without authentication, though high attack complexity is involved [1].

Impact

Successful exploitation allows an attacker to gain unauthorized access to the Spectrum Copy Data Management Admin console, potentially leading to disclosure of sensitive information, or further compromise of the system [1]. The CVSS score for this specific CVE is not provided, but related issues score up to 8.1 (Critical) [1].

Mitigation

IBM has released security updates to address this vulnerability. Users should apply the fix as described in the IBM support page [1]. No workarounds are documented; upgrading to a fixed version is recommended.