CVE-2020-4464

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. IBM X-Force ID: 181489.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
IBM	WebSphere Application Server	7.0; 8.0; 8.5; 9.0

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/181489VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6250059Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-878/Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/181489VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6250059Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-878/Third Party Advisory

Timeline

Published: Jul 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-44656.5IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS is vulnerable to a buffer overflow vulnerability due to an err CVE-2020-44666.5IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due to an error within th CVE-2020-44677.8IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by memory corruption CVE-2020-44687.8IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by memory corruption CVE-2020-44699.8IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially CVE-2020-44708.0IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which CVE-2020-44716.5IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions CVE-2020-44756.5IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sen CVE-2020-44767.5IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information CVE-2020-44776.5IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be us CVE-2020-44818.2IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when proces CVE-2020-44826.5IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow an authenticated user to bypass security. A user with access t