PT-2022-9038 · Ibm · Ibm Spectrum Protect Plus
CVE-2020-4497
·
Published
2022-12-14
·
Updated
2022-12-20
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
IBM Spectrum Protect Plus versions 10.1.0 through 10.1.12
Description
The issue discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum Protect Plus vSnap and its agents. An attacker could obtain information using man-in-the-middle techniques.
Recommendations
For versions 10.1.0 through 10.1.12, consider implementing encryption for the communication flow between Spectrum Protect Plus vSnap and its agents to prevent sensitive information disclosure. As a temporary workaround, restrict access to the communication flow to minimize the risk of exploitation.
Fix
Cleartext Transmission of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ibm Spectrum Protect Plus