CVE-2020-4470

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server. IBM X-Force ID: 181725.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
IBM	Spectrum Protect Plus	10.1.0; 10.1.5

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/181725VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6221358Patch, Vendor Advisory
https://www.tenable.com/security/research/tra-2020-37Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/181725VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6221358Patch, Vendor Advisory
https://www.tenable.com/security/research/tra-2020-37Third Party Advisory

Timeline

Published: Jun 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-44716.5IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions CVE-2020-44756.5IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sen CVE-2020-44767.5IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information CVE-2020-44776.5IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be us CVE-2020-44818.2IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when proces CVE-2020-44826.5IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow an authenticated user to bypass security. A user with access t CVE-2020-44834.3IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detai CVE-2020-44844.3IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could disclose sensitive information to an authenticated user that could b CVE-2020-44856.5IBM QRadar 7.2.0 through 7.2.9 could allow an authenticated user to disable the Wincollect service which could aid an attacker in bypassing CVE-2020-44868.1IBM QRadar 7.2.0 thorugh 7.2.9 could allow an authenticated user to overwrite or delete arbitrary files due to a flaw after WinCollect insta CVE-2020-44874.3IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is return CVE-2020-44906.1IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass secur