Clickjacking in IBM Spectrum Protect Client
Priority LOW 26CWE-1021Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-1021.
Summary
IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 (Linux), 8.1.9.0 through 8.1.9.1 (AIX) web user interfaces could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 179488.
Why it matters now
EPSS 0.00823 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Spectrum Protect Client (Linux and Windows) | 8.1.7.0; 8.1.9.1 | — | No fix listed | CNA |
| IBM | Spectrum Protect Client (AIX) | 8.1.9.0; 8.1.9.1 | — | No fix listed | CNA |
| IBM | Spectrum Protect for Space Management (AIX) | 8.1.9.0; 8.1.9.1 | — | No fix listed | CNA |
| IBM | Spectrum Protect for Space Management (Linux) | 8.1.7.0; 8.1.9.1 | — | No fix listed | CNA |
- Spectrum Protect Client (Linux and Windows) VendorIBM Affected 8.1.7.0; 8.1.9.1 Fixed in — No fix listed CNA
- Spectrum Protect Client (AIX) VendorIBM Affected 8.1.9.0; 8.1.9.1 Fixed in — No fix listed CNA
- Spectrum Protect for Space Management (AIX) VendorIBM Affected 8.1.9.0; 8.1.9.1 Fixed in — No fix listed CNA
- Spectrum Protect for Space Management (Linux) VendorIBM Affected 8.1.7.0; 8.1.9.1 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:spectrum_protect_client:*:*:*:*:*:*:*:* | 8.1.7.0 – 8.1.9.1 | Vulnerable | IBM |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:ibm:spectrum_protect_client:*:*:*:*:*:*:*:* | 8.1.9.0 – 8.1.9.1 | Vulnerable | IBM |
| cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:a:ibm:spectrum_protect_for_space_management:*:*:*:*:*:*:*:* | 8.1.7.0 – 8.1.9.1; 8.1.9.0 – 8.1.9.1 | Vulnerable | IBM |
- cpe:2.3:a:ibm:spectrum_protect_client:*:*:*:*:*:*:*:* Versions 8.1.7.0 – 8.1.9.1 Vulnerable ·IBM
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:ibm:spectrum_protect_client:*:*:*:*:*:*:*:* Versions 8.1.9.0 – 8.1.9.1 Vulnerable ·IBM
- cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:a:ibm:spectrum_protect_for_space_management:*:*:*:*:*:*:*:* Versions 8.1.7.0 – 8.1.9.1; 8.1.9.0 – 8.1.9.1 Vulnerable ·IBM
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-4406
- 2026-10-03 Alias added: GHSA-hfrq-mhmh-565m
References
More IBM Spectrum Protect Client vulnerabilities
- TI-2020-03837 Improper authentication in IBM Spectrum Protect for Space Management CVSS 3.1HIGH 7.5
- TI-2022-06757 IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes… CVSS 3.1HIGH 7.5
- TI-2018-01574 IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected… CVSS 3.1HIGH 7.5
- TI-2018-01402 IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected… CVSS 3.1HIGH 7.5
- TI-2021-10371 Out-of-bounds write in IBM Spectrum Protect for Space Management CVSS 3.1HIGH 7.8
- TI-2023-16710 IBM Storage Protect denial of service CVSS 3.1MEDIUM 6.2
Sources
- CVE-2020-4406 · CVE Program
- CVE-2020-4406 · NVD
- FIRST EPSS
- GHSA-hfrq-mhmh-565m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences