{"api_version":"1","generated_at":"2026-07-23T10:58:32+00:00","cve":"CVE-2020-4499","urls":{"html":"https://cve.report/CVE-2020-4499","api":"https://cve.report/api/cve/CVE-2020-4499.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-4499","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-4499"},"summary":{"title":"CVE-2020-4499","description":"IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2020-10-15 13:15:00","updated_at":"2021-07-21 11:39:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/182216","name":"ibm-sam-cve20204499-sec-bypass (182216)","refsource":"XF","tags":["VDB Entry","Vendor Advisory"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.ibm.com/support/pages/node/6348046","name":"https://www.ibm.com/support/pages/node/6348046","refsource":"CONFIRM","tags":["Patch","Vendor Advisory"],"title":"Security Bulletin: Security vulnerabilities have been fixed in the IBM Security Access Manager and IBM Security Verify Access products","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-4499","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-4499","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"4499","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_access_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"4499","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_access_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"4499","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_verify_access","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"4499","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_verify_access","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_format":"MITRE","problemtype":{"problemtype_data":[{"description":[{"value":"Bypass Security","lang":"eng"}]}]},"description":{"description_data":[{"value":"IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.","lang":"eng"}]},"impact":{"cvssv3":{"TM":{"RC":"C","E":"U","RL":"O"},"BM":{"I":"L","UI":"N","SCORE":"7.300","AC":"L","PR":"N","AV":"N","C":"L","S":"U","A":"L"}}},"CVE_data_meta":{"DATE_PUBLIC":"2020-10-14T00:00:00","STATE":"PUBLIC","ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2020-4499"},"references":{"reference_data":[{"refsource":"CONFIRM","title":"IBM Security Bulletin 6348046 (Security Access Manager)","name":"https://www.ibm.com/support/pages/node/6348046","url":"https://www.ibm.com/support/pages/node/6348046"},{"title":"X-Force Vulnerability Report","name":"ibm-sam-cve20204499-sec-bypass (182216)","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/182216","refsource":"XF"}]},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Security Verify Access","version":{"version_data":[{"version_value":"10.0.0"}]}},{"version":{"version_data":[{"version_value":"9.0.7"}]},"product_name":"Security Access Manager"}]},"vendor_name":"IBM"}]}},"data_type":"CVE","data_version":"4.0"},"nvd":{"publishedDate":"2020-10-15 13:15:00","lastModifiedDate":"2021-07-21 11:39:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.0.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:security_access_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.7.0","versionEndExcluding":"9.0.7.2","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"4499","Ordinal":"164527","Title":"CVE-2020-4499","CVE":"CVE-2020-4499","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"4499","Ordinal":"1","NoteData":"IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"4499","Ordinal":"2","NoteData":"2020-10-15","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"4499","Ordinal":"3","NoteData":"2020-10-15","Type":"Other","Title":"Modified"}]}}}