CVE-2020-4477

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the system. IBM X-Force ID: 181779.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
IBM	Spectrum Protect Plus	10.1.0; 10.1.5

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/181779VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6221388Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/181779VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6221388Patch, Vendor Advisory

Timeline

Published: Jun 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-44818.2IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when proces CVE-2020-44826.5IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow an authenticated user to bypass security. A user with access t CVE-2020-44834.3IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detai CVE-2020-44844.3IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could disclose sensitive information to an authenticated user that could b CVE-2020-44856.5IBM QRadar 7.2.0 through 7.2.9 could allow an authenticated user to disable the Wincollect service which could aid an attacker in bypassing CVE-2020-44868.1IBM QRadar 7.2.0 thorugh 7.2.9 could allow an authenticated user to overwrite or delete arbitrary files due to a flaw after WinCollect insta CVE-2020-44874.3IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is return CVE-2020-44906.1IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass secur CVE-2020-44915.5IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial of service by sendi CVE-2020-44925.5IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a denial of service crashi CVE-2020-44939.8IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow an attacker to bypass authentication and issue commands using a specially crafted HT CVE-2020-44947.5IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Man