Medium · 4.0 CVE-2020-5021 EUVD-2020-26268GHSA-6rqr-xfwj-w2q9

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impers…

Published Jan 8, 2021 · Updated Sep 16, 2024 · Assigned by ibm

Vendor: IBM Product: Spectrum Protect Plus

Description

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system. IBM X-Force ID: 193657.

Affected products

Vendor	Product	Affected	Fixed
IBM	Spectrum Protect Plus	10.1.0, 10.1.6	—

References

https://www.ibm.com/support/pages/node/6398754
ibm-spectrum-cve20205021-session-fixation (193657) vdb-entry