CVE-2020-4125

Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the link, giving the attacker access to confidential information.

CVSS v3 8.1 HIGH
CVSS v2.0 5.5 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080941	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:marketing_operations::::::::
	cpe:2.3:a:ibm:marketing_operations::::::::
	cpe:2.3:a:ibm:marketing_operations:9.1.2.4:::::::*

History

No history.

Information

Published : 2020-07-20 22:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-4125

Mitre link : CVE-2020-4125

CVE.ORG link : CVE-2020-4125

JSON object : View

Products Affected

ibm

marketing_operations

CWE

CWE-494

Download of Code Without Integrity Check

{"id": "CVE-2020-4125", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2020-07-20T22:15:11.907", "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080941", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-494"}]}], "descriptions": [{"lang": "en", "value": "Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the link, giving the attacker access to confidential information."}, {"lang": "es", "value": "Usando HCL Marketing Operations versiones 9.1.2.4, 10.1.x, 11.1.0.x, un atacante malicioso podr\u00eda descargar archivos desde el entorno RHEL al hacer alguna modificaci\u00f3n en el enlace, d\u00e1ndole acceso al atacante a informaci\u00f3n confidencial"}], "lastModified": "2020-07-24T11:54:55.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:marketing_operations:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FAA8655-5455-48BB-A49F-CA6EC1BE05DC", "versionEndIncluding": "10.1.0.3", "versionStartIncluding": "10.1"}, {"criteria": "cpe:2.3:a:ibm:marketing_operations:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34C94E81-6269-4A32-AD6B-4E659C1C5130", "versionEndIncluding": "11.1.0.2", "versionStartIncluding": "11.1.0.1"}, {"criteria": "cpe:2.3:a:ibm:marketing_operations:9.1.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A70F5BA-22A6-47A3-89EA-91182624A85B"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}