Medium severity · published Nov 30, 2020
CVE-2020-4696
IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated user to obtain sensitive information from the previous session
4.3
CVSS
0.8%
EPSS
No
On KEV
Description
IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated user to obtain sensitive information from the previous session. IBM X-Force ID: 186789.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Cloud Pak For Security · Ibm
1.3.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-4696
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-4696
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/186789
Patch
https://www.ibm.com/support/pages/node/6372528
More from Cloud Pak For Security
9.8
CVE-2021-20578
IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls
9.1
CVE-2021-20538
IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect…
9.0
CVE-2020-4627
IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection
8.8
CVE-2025-25022
IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure
8.8
CVE-2023-47726
IBM QRadar Suite improper input validation