Read the docs
TI-2020-03837 Aliases CVE-2020-4494GHSA-gww9-rjpc-m25m

Improper authentication in IBM Spectrum Protect for Space Management

Priority LOW 37CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 (Linux), 8.1.9.0 through 8.1.9.1 (AIX) web user interfaces could allow an attacker to bypass authentication due to improper session validation which can result in access to unauthorized resources. IBM X-Force ID: 182019.

Why it matters now

EPSS 0.02285 83rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMSpectrum Protect for Space Management (Linux)8.1.7.0; 8.1.9.1—No fix listedCNA
IBMSpectrum Protect for Space Management (AIX)8.1.9.0; 8.1.9.1—No fix listedCNA
IBMSpectrum Protect Client (AIX)8.1.9.0; 8.1.9.1—No fix listedCNA
IBMSpectrum Protect Client (Linux and Windows)8.1.7.0; 8.1.9.1—No fix listedCNA
  • Spectrum Protect for Space Management (Linux) VendorIBM Affected 8.1.7.0; 8.1.9.1 Fixed in — No fix listed CNA
  • Spectrum Protect for Space Management (AIX) VendorIBM Affected 8.1.9.0; 8.1.9.1 Fixed in — No fix listed CNA
  • Spectrum Protect Client (AIX) VendorIBM Affected 8.1.9.0; 8.1.9.1 Fixed in — No fix listed CNA
  • Spectrum Protect Client (Linux and Windows) VendorIBM Affected 8.1.7.0; 8.1.9.1 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:ibm:spectrum_protect_client:*:*:*:*:*:*:*:*8.1.7.0 – 8.1.9.1VulnerableIBM
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:ibm:spectrum_protect_client:*:*:*:*:*:*:*:*8.1.9.0 – 8.1.9.1VulnerableIBM
cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:a:ibm:spectrum_protect_for_space_management:*:*:*:*:*:*:*:*8.1.7.0 – 8.1.9.1; 8.1.9.0 – 8.1.9.1VulnerableIBM
  • cpe:2.3:a:ibm:spectrum_protect_client:*:*:*:*:*:*:*:* Versions 8.1.7.0 – 8.1.9.1 Vulnerable ·IBM
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:ibm:spectrum_protect_client:*:*:*:*:*:*:*:* Versions 8.1.9.0 – 8.1.9.1 Vulnerable ·IBM
  • cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:a:ibm:spectrum_protect_for_space_management:*:*:*:*:*:*:*:* Versions 8.1.7.0 – 8.1.9.1; 8.1.9.0 – 8.1.9.1 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-4494
  2. 2026-10-03 Alias added: GHSA-gww9-rjpc-m25m

References

Advisory 1

  • TI-2022-06757 IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes… CVSS 3.1HIGH 7.5
  • TI-2018-01574 IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected… CVSS 3.1HIGH 7.5
  • TI-2018-01402 IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected… CVSS 3.1HIGH 7.5
  • TI-2021-10371 Out-of-bounds write in IBM Spectrum Protect for Space Management CVSS 3.1HIGH 7.8
  • TI-2023-16710 IBM Storage Protect denial of service CVSS 3.1MEDIUM 6.2
  • TI-2020-03781 Clickjacking in IBM Spectrum Protect Client CVSS 3.1MEDIUM 5.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences