TI-2020-03840 Aliases CVE-2020-4497 GHSA-m376-rjrp-x9hg

IBM Spectrum Protect Plus information disclosure

LOW 30CWE-319Published 2022-12-14 · Updated 2025-04-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum Protect Plus vSnap and its agents. An attacker could obtain information using main in the middle techniques. IBM X-Force ID: 182106.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00413 35th percentileScored 2026-11-07

Fix Fixed Spectrum Protect Plus (IBM): 10.1.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	Spectrum Protect Plus	10.1.0 to before 10.1.12	10.1.12	Patch available	CNA

Spectrum Protect Plus VendorIBM Affected 10.1.0 to before 10.1.12 Fixed in 10.1.12 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ibm:spectrum_protect_plus::::::::	10.1.0 to before 10.1.13	Vulnerable	IBM

cpe:2.3:a:ibm:spectrum_protect_plus:*:*:*:*:*:*:*:* Versions 10.1.0 to before 10.1.13 Vulnerable ·IBM

Remediation

Fix · CNA Spectrum Protect Plus (IBM) Fixed in 10.1.12

Timeline

2026-10-02 Threatist record created from CVE-2020-4497
2026-10-03 Alias added: GHSA-m376-rjrp-x9hg

References

Patch 1

https://www.ibm.com/support/pages/node/6847627

TI-2020-03654 OS command injection in IBM Spectrum Protect Plus CVSS 3.1HIGH 8.8
TI-2020-03820 OS command injection in IBM Spectrum Protect Plus CVSS 3.1CRITICAL 9.8
TI-2020-04093 Hard-coded credentials in IBM Spectrum Protect Plus CVSS 3.1CRITICAL 9.8
TI-2020-03630 Hard-coded credentials in IBM Spectrum Protect Plus CVSS 3.1CRITICAL 9.8
TI-2020-03628 Improper input validation in IBM Spectrum Protect Plus CVSS 3.1HIGH 8.8
TI-2020-03655 OS command injection in IBM Spectrum Protect Plus CVSS 3.1HIGH 8.8

See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences