CVE-2021-39051

Name of the Vulnerable Software and Affected Versions IBM Spectrum Copy Data Management versions 2.2.0.0 through 2.2.14.3

Description The issue is caused by improper input of the application server registration function, leading to server-side request forgery. A remote attacker could exploit this using the host address and port fields of the application server registration form in the portal UI to enumerate and attack services running on those hosts.

Recommendations For versions 2.2.0.0 through 2.2.14.3, update to a version that fixes the improper input of the application server registration function to prevent server-side request forgery. As a temporary workaround, consider restricting access to the application server registration form in the portal UI to minimize the risk of exploitation.