{"api_version":"1","generated_at":"2026-07-23T10:49:39+00:00","cve":"CVE-2020-5022","urls":{"html":"https://cve.report/CVE-2020-5022","api":"https://cve.report/api/cve/CVE-2020-5022.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-5022","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-5022"},"summary":{"title":"CVE-2020-5022","description":"IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining information they are not authorized to access. IBM X-Force ID: 193658.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2021-01-08 19:15:00","updated_at":"2021-07-21 11:39:00"},"problem_types":["CWE-306","CWE-862"],"metrics":[],"references":[{"url":"https://www.ibm.com/support/pages/node/6398754","name":"https://www.ibm.com/support/pages/node/6398754","refsource":"CONFIRM","tags":["Patch","Vendor Advisory"],"title":"Security Bulletin: Multiple vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-5017, CVE-2020-5018, CVE-2020-5019, CVE-2020-5020, CVE-2020-5021, CVE-2020-5022)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/193658","name":"ibm-spectrum-cve20205022-info-disc (193658)","refsource":"XF","tags":["VDB Entry","Vendor Advisory"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-5022","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5022","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"5022","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"spectrum_protect_plus","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"5022","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"spectrum_protect_plus","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"5022","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"5022","vulnerable":"0","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ID":"CVE-2020-5022","DATE_PUBLIC":"2021-01-07T00:00:00","STATE":"PUBLIC","ASSIGNER":"psirt@us.ibm.com"},"problemtype":{"problemtype_data":[{"description":[{"value":"Obtain Information","lang":"eng"}]}]},"data_type":"CVE","data_version":"4.0","references":{"reference_data":[{"refsource":"CONFIRM","name":"https://www.ibm.com/support/pages/node/6398754","url":"https://www.ibm.com/support/pages/node/6398754","title":"IBM Security Bulletin 6398754 (Spectrum Protect Plus)"},{"title":"X-Force Vulnerability Report","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/193658","name":"ibm-spectrum-cve20205022-info-disc (193658)","refsource":"XF"}]},"description":{"description_data":[{"lang":"eng","value":"IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining information they are not authorized to access. IBM X-Force ID: 193658."}]},"data_format":"MITRE","impact":{"cvssv3":{"TM":{"RL":"O","RC":"C","E":"U"},"BM":{"C":"L","AC":"L","PR":"N","UI":"N","SCORE":"5.300","A":"N","S":"U","AV":"N","I":"N"}}},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Spectrum Protect Plus","version":{"version_data":[{"version_value":"10.1.0"},{"version_value":"10.1.6"}]}}]},"vendor_name":"IBM"}]}}},"nvd":{"publishedDate":"2021-01-08 19:15:00","lastModifiedDate":"2021-07-21 11:39:00","problem_types":["CWE-306","CWE-862"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:spectrum_protect_plus:*:*:*:*:*:*:*:*","versionStartIncluding":"10.1.0","versionEndExcluding":"10.1.7","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"5022","Ordinal":"165050","Title":"CVE-2020-5022","CVE":"CVE-2020-5022","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"5022","Ordinal":"1","NoteData":"IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining information they are not authorized to access. IBM X-Force ID: 193658.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"5022","Ordinal":"2","NoteData":"2021-01-08","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"5022","Ordinal":"3","NoteData":"2021-01-08","Type":"Other","Title":"Modified"}]}}}