Read the docs
TI-2020-04010 Aliases CVE-2020-4717GHSA-rfxj-hq8g-hc57

Link following in IBM SPSS Modeler

Priority LOW 25CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability exists in IBM SPSS Modeler Subscription Installer that allows a user with create symbolic link permission to write arbitrary file in another protected path during product installation. IBM X-Force ID: 187727.

Why it matters now

EPSS 0.00335 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMSPSS ModelerSubscription—No fix listedCNA
  • SPSS Modeler VendorIBM Affected Subscription Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ibm:spss_modeler:-:*:*:*:*:*:*:*not specified by NVDVulnerableIBM
  • cpe:2.3:a:ibm:spss_modeler:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-4717
  2. 2026-10-03 Alias added: GHSA-rfxj-hq8g-hc57

References

Advisory 1

  • TI-2012-04817 IBM SPSS Modeler 14.0, 14.1, 14.2 through FP3, and 15.0 before FP2 allows remote… CVSS 2.0MEDIUM 5.8
  • TI-2023-16719 IBM SPSS Modeler information disclosure CVSS 3.1MEDIUM 6.2
  • TI-2013-05554 IBM SPSS Modeler before 16 on UNIX allows remote authenticated users to bypass intended… CVSS 3.0MEDIUM 5.4
  • TI-2015-04191 IBM SPSS Modeler 14.2 through FP3 IF027, 15 through FP3 IF015, 16 through FP2 IF012, 17… CVSS 3.0MEDIUM 4.0
  • TI-2014-02425 IBM SPSS Modeler 16.0 before 16.0.0.1 on UNIX does not properly drop group privileges… CVSS 2.0LOW 3.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences