CVE-2020-4427

IBM Data Risk Manager versions 2.0.1 through 2.0.6 contain an improper authentication flaw (CWE-287) that allows an unauthenticated remote attacker to bypass security when the appliance is configured for SAML authentication. By sending a specially crafted HTTP request, the attacker can circumvent the authentication process entirely. Successful exploitation yields full administrative access to the system, with high impact on confidentiality, integrity and availability, reflected in the critical 9.8 CVSS score. Only deployments that use SAML authentication are affected; installations using other authentication methods are not exposed to this flaw. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, indicating exploitation in the wild, and EPSS assigns a 70% probability of exploitation within 30 days.

What to do: Apply IBM's update per vendor instructions, as required by CISA's KEV listing; IBM's security bulletin addresses this flaw in Data Risk Manager 2.0.6.1. Until patched, restrict network access to the appliance's management interface and consider temporarily switching from SAML to non-SAML authentication, since only SAML-configured deployments are vulnerable. Verify whether your deployment uses SAML and review appliance logs for unexpected administrative logins or anomalous HTTP requests.