Read the docs
TI-2020-03789 Aliases CVE-2020-4415GHSA-j8gx-2792-8g3x

Improper input validation in IBM Spectrum Protect

Priority MEDIUM 53CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

IBM Spectrum Protect 7.1 and 8.1 server is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker to execute arbitrary code on the system with the privileges of an administrator or user associated with the Spectrum Protect server or cause the Spectrum Protect server to crash. IBM X-Force ID: 179990.

Why it matters now

EPSS 0.08052 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMSpectrum Protect7.1.0.0; 7.1.10.0; 8.1.0.0; 8.1.9.200—No fix listedCNA
  • Spectrum Protect VendorIBM Affected 7.1.0.0; 7.1.10.0; 8.1.0.0; 8.1.9.200 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ibm:spectrum_protect:*:*:*:*:*:*:*:*7.1.0.0 – 7.1.10.0; 8.1.0.0 – 8.1.9.200VulnerableIBM
  • cpe:2.3:a:ibm:spectrum_protect:*:*:*:*:*:*:*:* Versions 7.1.0.0 – 7.1.10.0; 8.1.0.0 – 8.1.9.200 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-4415
  2. 2026-10-03 Alias added: GHSA-j8gx-2792-8g3x

References

Patch 1

  • TI-2020-03633 OS command injection in IBM Spectrum Protect Plus CVSS 3.1CRITICAL 9.8
  • TI-2020-03639 OS command injection in IBM Spectrum Protect Plus CVSS 3.1CRITICAL 9.8
  • TI-2020-03635 OS command injection in IBM Spectrum Protect Plus CVSS 3.1CRITICAL 9.8
  • TI-2020-03634 Improper input validation in IBM Spectrum Protect Plus CVSS 3.1CRITICAL 9.8
  • TI-2020-03632 OS command injection in IBM Spectrum Protect Plus CVSS 3.1CRITICAL 9.8
  • TI-2022-06707 The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass… CVSS 3.1HIGH 8.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences