CVE-2020-4555

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 183328.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
IBM	Financial Transaction Manager	3.0.2; 2.1.1; 3.1.0; 3.0.5; 3.0.6; 3.0.0; 3.2.2; 3.2.3; 3.2.4

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/183328VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6388702Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6388704Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6388706Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6388708Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6388722Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6388744Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/183328VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6388702Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6388704Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6388706Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6388708Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6388722Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6388744Patch, Vendor Advisory

Timeline

Published: Dec 21, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-45563.3IBM Financial Transaction Manager for High Value Payments for Multi-Platform 3.2.0 through 3.2.10 allows web pages to be stored locally whic CVE-2020-45575.4IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. T CVE-2020-45597.5IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. IBM CVE-2020-45606.1IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript CVE-2020-456110.0IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attac CVE-2020-45625.3IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by allowing cross-window communication with unrestr CVE-2020-45645.4IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 are vulnerable to CVE-2020-45655.9IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications being CVE-2020-45666.5IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 stores potentially highly sensitive informa CVE-2020-45679.8IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force CVE-2020-45685.5IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X CVE-2020-45696.5IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the existence or values of an input, but the input