« Volver al listado

CVE-2020-4767

Estado: ModificadaAlta (7.5)—

IBM Sterling Connect Direct for Microsoft Windows 4.7, 4.8, 6.0, and 6.1 could allow a remote attacker to cause a denial of service, caused by a buffer over-read. Bysending a specially crafted request, the attacker could cause the application to crash. IBM X-Force ID: 188906.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Sterling Connect\

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-4767",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "Sterling Connect Direct for Microsoft Windows",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-10-28T17:15:12.920",
  "references": [
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/188906",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://www.ibm.com/support/pages/node/6356019",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/188906",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.ibm.com/support/pages/node/6356019",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Sterling Connect Direct for Microsoft Windows 4.7, 4.8, 6.0, and 6.1 could allow a remote attacker to cause a denial of service, caused by a buffer over-read. Bysending a specially crafted request, the attacker could cause the application to crash. IBM X-Force ID: 188906."
    },
    {
      "lang": "es",
      "value": "IBM Sterling Connect Direct para Microsoft Windows versiones 4.7, 4.8, 6.0 y 6.1, podría permitir a un atacante remoto causar una denegación de servicio, causada por una lectura excesiva del búfer. Mediante el envío de una petición  especialmente diseñada, el atacante podría causar que la aplicación se bloquee. IBM X-Force ID: 188906"
    }
  ],
  "lastModified": "2026-06-17T03:20:27.310",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "786BBE56-AD12-4461-A338-00550898F2CB",
              "versionEndExcluding": "4.7.0.7",
              "versionStartIncluding": "4.7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73112C08-4C4D-45E0-9A89-ADF9CEE13288",
              "versionEndExcluding": "4.8.0.3",
              "versionStartIncluding": "4.8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1296A3F9-2589-440B-9ED5-44080A2BBA4F",
              "versionEndExcluding": "6.0.0.4",
              "versionStartIncluding": "6.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:sterling_connect\\:direct:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA26AE23-E02F-47EB-92D8-085674815F65",
              "versionEndExcluding": "6.1.0.1",
              "versionStartIncluding": "6.1.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}