Skip to main content

Cloud Pak For Security CVE-2020-4627

CRITICAL
Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
2020-11-30 psirt@us.ibm.com
IBM Code Injection Cloud Pak For Security
9.0
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.0 CRITICAL
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Nov 30, 2020 - 16:15 nvd
CRITICAL 9.0

DescriptionNVD

IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367.

AnalysisAI

IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-1236. IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367. Affected products include: Ibm Cloud Pak For Security.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cloud Pak For Security

View all
CVE-2021-20578 CRITICAL
9.8 Sep 30

IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized
CVE-2025-25022 CRITICAL
9.6 Jun 03

Credential exposure in IBM QRadar Suite 1.10.12.0-1.11.2.0.
CVE-2021-20538 CRITICAL
9.1 May 10

IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform acti
CVE-2022-38387 HIGH
8.8 Nov 11

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbit
CVE-2022-38385 HIGH
8.1 Nov 15

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow an authenticated user to obtain highly sensitive
CVE-2024-28799 HIGH
7.5 Aug 14

IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 displays
CVE-2023-30993 HIGH
7.5 Jun 27

IBM Cloud Pak for Security (CP4S) 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to
CVE-2021-29894 HIGH
7.5 Sep 30

IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorit
CVE-2025-25021 HIGH
7.2 Jun 03

CVE-2025-25021 is a security vulnerability (CVSS 7.2) that allows a privileged execute code. High severity vulnerability
CVE-2021-29696 HIGH
7.2 Aug 02

IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenti
CVE-2025-25020 MEDIUM
6.5 Jun 03

IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could all
CVE-2024-28782 MEDIUM
6.5 Apr 03

IBM QRadar Suite Software 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores u

Same weakness CWE-1236 – Improper Neutralization of Formula Elements in a CSV File

View all
CVE-2019-14749 HIGH POC
8.8
CVE-2020-36962 CRITICAL POC
9.8
CVE-2023-46401 CRITICAL POC
9.8
CVE-2025-56267 CRITICAL POC
9.8
CVE-2021-47901 CRITICAL POC
9.8
CVE-2020-36941 CRITICAL POC
9.8
CVE-2022-3574 CRITICAL POC
9.8
CVE-2022-3463 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Share

CVE-2020-4627 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy