CVE-2021-20491

Severity Score

4.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking during the parsing of commands. By issuing such a command with an improper parameter, an authorized administrator could overflow a buffer and cause the server to crash. IBM X-Force ID: 197792.

IBM Spectrum Protect Server versiones 7.1 y 8.1, está sujeto a un desbordamiento de búfer en la región stack de la memoria causado por una comprobación de límites inapropiada durante el análisis de los comandos. Al emitir un comando de este tipo con un parámetro inapropiado, un administrador autorizado podría desbordar un búfer y causar que el servidor se bloquee. IBM X-Force ID: 197792

*Credits: N/A

CVSS Scores

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-12-17 CVE Reserved
2021-04-16 CVE Published
2023-03-08 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-787: Out-of-bounds Write

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://www.ibm.com/support/pages/node/6442993	2021-04-21

URL	Date	SRC
https://exchange.xforce.ibmcloud.com/vulnerabilities/197792	2021-04-21

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Ibm Search vendor "Ibm"		Spectrum Protect Search vendor "Ibm" for product "Spectrum Protect"				>= 7.1.0.000 < 7.1.13 Search vendor "Ibm" for product "Spectrum Protect" and version " >= 7.1.0.000 < 7.1.13"		-		Affected
Ibm Search vendor "Ibm"		Spectrum Protect Search vendor "Ibm" for product "Spectrum Protect"				>= 8.1.0.000 <= 8.1.10.100 Search vendor "Ibm" for product "Spectrum Protect" and version " >= 8.1.0.000 <= 8.1.10.100"		-		Affected
Ibm Search vendor "Ibm"		Spectrum Protect Search vendor "Ibm" for product "Spectrum Protect"				8.1.11.000 Search vendor "Ibm" for product "Spectrum Protect" and version "8.1.11.000"		-		Affected