CVE-2020-4781 Denial of service in Curam SPM

What is CVE-2020-4781?

CVE-2020-4781 is a medium-severity denial of service vulnerability in IBM Curam SPM, published on 12 Oct 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could result in a denial of service. IBM X-Force ID: 189159.

Weakness: CWE-20

Which versions are affected by CVE-2020-4781?

It affects 1 product.

Products include Ibm Curam Social Program Management.

How do I fix CVE-2020-4781?

No fix has been published for CVE-2020-4781 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-4781 being exploited?

There is no known exploitation of CVE-2020-4781 in the wild and no public exploit code.

Other vulnerabilities in IBM Curam SPM

• CVE-2016-6111 XML external entity in Cram Social Program Management Critical 9.1
• CVE-2014-8903 Code injection in n/a High 8.8
• CVE-2020-4779 Auth bypass in Curam SPM High 8.1
• CVE-2020-4772 XML external entity in Curam SPM High 7.1
• CVE-2018-1654 Open redirect in Curam Social Program Management Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wfr7-6ghr-5g47.