CVE-2020-4429 Hardcoded credentials in Data Risk Manager
Remote attackers can use a default administrative password to log in and execute arbitrary code with root privileges on IBM Data Risk Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-4429?
CVE-2020-4429 is a critical vulnerability in IBM Data Risk Manager, published on 7 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID: 180534.
Weakness: CWE-798
Which versions are affected by CVE-2020-4429?
It affects 1 product.
Products include Ibm Data Risk Manager.
How do I fix CVE-2020-4429?
No fix has been published for CVE-2020-4429 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-4429 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-4429 exists.
Public exploit code: 3 Metasploit modules and 1 Nuclei template.
Other vulnerabilities in IBM Data Risk Manager
Sources
Also known as GHSA-5634-wp84-cm8x.