CVE-2021-20488 Privilege escalation in Security Identity Manager
An authenticated user can change other users' passwords in Windows AD via the IBM Security Identity Manager Windows Password Synch Plug-in.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20488?
CVE-2021-20488 is a high-severity vulnerability in IBM Security Identity Manager, published on 16 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM Security Identity Manager Windows Password Synch Plug-in is deployed and configured. IBM X-Force ID: 197789.
Which versions are affected by CVE-2021-20488?
It affects 1 product.
Products include Ibm Security Identity Manager.
How do I fix CVE-2021-20488?
No fix has been published for CVE-2021-20488 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20488 being exploited?
There is no known exploitation of CVE-2021-20488 in the wild and no public exploit code.
Other vulnerabilities in IBM Security Identity Manager
Sources
Also known as GHSA-x6hg-qh4q-23x7.