CVE-2021-39065

Name of the Vulnerable Software and Affected Versions IBM Spectrum Copy Data Management versions 2.2.13 and earlier

Description The issue is caused by improper validation of user-supplied input by the Spectrum Copy Data Management Admin Console login and uploadcertificate function. This allows a remote attacker to inject arbitrary shell commands, which would be executed on the affected system.

Recommendations For IBM Spectrum Copy Data Management versions 2.2.13 and earlier, update to a version later than 2.2.13 to resolve the issue. As a temporary workaround, consider restricting access to the Spectrum Copy Data Management Admin Console login and uploadcertificate function to minimize the risk of exploitation.