CVE-2021-20488

IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM Security Identity Manager Windows Password Synch Plug-in is deployed and configured. IBM X-Force ID: 197789.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
ibmCNA
7.5 HIGH
NETWORK
HIGH
LOW
CVSS:3.0/AV:N/C:H/PR:L/UI:N/A:H/S:U/AC:H/I:H/E:U/RL:O/RC:C
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 41%
VendorProductVersion
ibmsecurity_identity_manager
6.0.2
𝑥
= Vulnerable software versions
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/197789
https://www.ibm.com/support/pages/node/6464081
https://exchange.xforce.ibmcloud.com/vulnerabilities/197789
https://www.ibm.com/support/pages/node/6464081