CVE-2020-4618 Denial of service in Data Risk Manager

What is CVE-2020-4618?

CVE-2020-4618 is a medium-severity denial of service vulnerability in IBM Data Risk Manager, published on 22 Sep 2020. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

IBM Data Risk Manager (iDNA) 2.0.6 could allow a privileged user to cause a denial of service due to improper input validation. IBM X-Force ID: 184937.

Weakness: CWE-20

Which versions are affected by CVE-2020-4618?

It affects 1 product.

Products include Ibm Data Risk Manager.

How do I fix CVE-2020-4618?

No fix has been published for CVE-2020-4618 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-4618 being exploited?

There is no known exploitation of CVE-2020-4618 in the wild and no public exploit code.

Other vulnerabilities in IBM Data Risk Manager

• CVE-2020-4428 IBM Data Risk Manager Remote Code Execution Exploited Critical 9.1
• CVE-2020-4427 IBM Data Risk Manager Security Bypass Exploited Critical 9.0
• CVE-2020-4430 IBM Data Risk Manager Directory Traversal Exploited Medium 4.3
• CVE-2020-4429 Hardcoded credentials in Data Risk Manager Critical 10.0
• CVE-2020-4611 Privilege escalation in Data Risk Manager High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-97jp-gj5w-5gwc.