CVE-2020-4464
IBM WebSphere Application Server SOAP Deserialization of Untrusted Data Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. IBM X-Force ID: 181489.
IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0, tradicionalmente podría permitir a un atacante remoto ejecutar código arbitrario en un sistema con una secuencia especialmente diseñada de objetos serializados a través del conector SOAP. IBM X-Force ID: 181489
This vulnerability allows remote attackers to execute arbitrary code on affected installations of IBM WebSphere. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the SOAP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-12-30 CVE Reserved
- 2020-07-17 CVE Published
- 2022-08-17 First Exploit
- 2024-08-25 EPSS Updated
- 2024-09-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-502: Deserialization of Untrusted Data
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
https://www.zerodayinitiative.com/advisories/ZDI-20-878 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://github.com/yonggui-li/CVE-2020-4464-and-CVE-2020-4450 | 2022-08-17 |
URL | Date | SRC |
---|---|---|
https://www.ibm.com/support/pages/node/6250059 | 2020-07-22 |
URL | Date | SRC |
---|---|---|
https://exchange.xforce.ibmcloud.com/vulnerabilities/181489 | 2020-07-22 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Ibm Search vendor "Ibm" | Websphere Application Server Search vendor "Ibm" for product "Websphere Application Server" | >= 7.0.0.0 <= 7.0.0.45 Search vendor "Ibm" for product "Websphere Application Server" and version " >= 7.0.0.0 <= 7.0.0.45" | - |
Affected
| ||||||
Ibm Search vendor "Ibm" | Websphere Application Server Search vendor "Ibm" for product "Websphere Application Server" | >= 8.0.0.0 <= 8.0.0.15 Search vendor "Ibm" for product "Websphere Application Server" and version " >= 8.0.0.0 <= 8.0.0.15" | - |
Affected
| ||||||
Ibm Search vendor "Ibm" | Websphere Application Server Search vendor "Ibm" for product "Websphere Application Server" | >= 8.5.0.0 <= 8.5.5.17 Search vendor "Ibm" for product "Websphere Application Server" and version " >= 8.5.0.0 <= 8.5.5.17" | - |
Affected
| ||||||
Ibm Search vendor "Ibm" | Websphere Application Server Search vendor "Ibm" for product "Websphere Application Server" | >= 9.0.0.0 <= 9.0.5.4 Search vendor "Ibm" for product "Websphere Application Server" and version " >= 9.0.0.0 <= 9.0.5.4" | - |
Affected
|