{"vulnerability": "CVE-2020-4427", "sightings": [{"uuid": "9d454cbe-e5ab-493c-bc40-6e7e81762bbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "52dc1489-6cbf-4991-9506-f88f374bbe78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "ddc7f962-0729-4886-bf99-362628b758dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971059", "content": "", "creation_timestamp": "2024-12-24T20:23:40.928464Z"}, {"uuid": "96762713-c8e6-4da5-b915-21cbe91e380d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "4df054ca-8c6a-4c2f-84ab-bdf4a3cb190a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:29.000000Z"}, {"uuid": "6dc21b4d-fa40-4c8f-b94f-2f05034eb50b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:48.000000Z"}, {"uuid": "a85d5023-1bec-4407-a07a-e3cc41ad44c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-4427.yaml", "content": "", "creation_timestamp": "2025-10-10T14:50:08.000000Z"}, {"uuid": "49cc203d-141f-4cb6-ac03-4055c178b8c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/ibm_drm_download.rb", "content": "", "creation_timestamp": "2020-05-05T17:17:40.000000Z"}, {"uuid": "c55d39f8-9368-47de-8cd5-b7687a109b0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ibm_drm_rce.rb", "content": "", "creation_timestamp": "2020-05-05T17:17:40.000000Z"}, {"uuid": "95674837-a659-49fd-939d-526751abc0ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m344f7d7hn2q", "content": "", "creation_timestamp": "2025-10-13T21:02:38.937600Z"}, {"uuid": "75324e41-38b4-4d7a-b501-8cf470e96cc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/67f2a5e1-2bfc-4b61-ac8b-fb96fb4920c6", "content": "", "creation_timestamp": "2026-02-02T12:28:47.117190Z"}, {"uuid": "e1add314-45bf-47d1-8e55-1531d3364d62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "Telegram/rc6xw8zpitTyO5ZwnI7v_paRlIQp4IGwRgH4C44pyV9IokuV", "content": "", "creation_timestamp": "2025-02-14T10:05:09.000000Z"}, {"uuid": "d9d63509-44fb-468d-a732-6bd4c8d67c38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "https://t.me/arpsyndicate/1099", "content": "#ExploitObserverAlert\n\nCVE-2020-4427\n\nDESCRIPTION: Exploit Observer has 6 entries related to CVE-2020-4427. IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.\n\nFIRST-EPSS: 0.009980000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-12-04T03:06:45.000000Z"}, {"uuid": "2ce53c93-4a4d-45fb-bd68-6ca6be5cb697", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-05)", "content": "", "creation_timestamp": "2026-05-05T00:00:00.000000Z"}, {"uuid": "5bf2b014-010f-4402-8409-44461fe33c5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-05-09)", "content": "", "creation_timestamp": "2026-05-09T00:00:00.000000Z"}, {"uuid": "419da6b5-de89-432d-850c-a4f5355522c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-05-10)", "content": "", "creation_timestamp": "2026-05-10T00:00:00.000000Z"}, {"uuid": "dc542980-7eee-46a2-ab34-5c32a1837501", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-05-18)", "content": "", "creation_timestamp": "2026-05-18T00:00:00.000000Z"}, {"uuid": "11ebde8b-0e3b-48e0-987c-3eb804fc43c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-05-19)", "content": "", "creation_timestamp": "2026-05-19T00:00:00.000000Z"}, {"uuid": "910f3c3e-9f8c-47cf-93ee-8ecedcd1fd9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-05-29)", "content": "", "creation_timestamp": "2026-05-29T00:00:00.000000Z"}, {"uuid": "d791f1df-c324-446b-a1c0-41aeb94464a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-14)", "content": "", "creation_timestamp": "2026-06-14T00:00:00.000000Z"}, {"uuid": "507fb22e-6f4c-4f28-a422-705d81637789", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/39537ca6-ca8a-4256-bcff-92eabd7fd392", "content": "", "creation_timestamp": "2026-06-19T12:47:47.602984Z"}, {"uuid": "fb5f1f8a-0106-4833-91bc-328cf38d24cd", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c1a36628-db20-4ebd-afe1-4fea79981a1d", "content": "", "creation_timestamp": "2026-06-23T14:04:41.372220Z"}, {"uuid": "8eb06f00-e2da-4589-a502-6623b6d25ee3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-27)", "content": "", "creation_timestamp": "2026-06-28T10:15:08.434476Z"}, {"uuid": "15123e7c-700d-4f20-9fb4-0f12574c3238", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ca72b103-42bc-47ae-8ca6-33afe0f0dd49", "content": "", "creation_timestamp": "2026-06-30T09:22:44.645826Z"}, {"uuid": "3e9b78fc-487f-4e58-98a4-186c26a3cb76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-29)", "content": "", "creation_timestamp": "2026-06-30T10:15:14.490487Z"}, {"uuid": "f4d30342-ef5a-4f9f-847b-3e3aca814629", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-04)", "content": "", "creation_timestamp": "2026-07-05T10:15:43.183161Z"}, {"uuid": "e78944f5-9038-44a3-85bb-847a8fb6773a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-07)", "content": "", "creation_timestamp": "2026-07-08T10:15:09.228492Z"}, {"uuid": "96cdb82c-5ddf-4a5d-ae0e-b8f17c837141", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-08)", "content": "", "creation_timestamp": "2026-07-09T10:15:12.623733Z"}, {"uuid": "fcbae897-4142-4af9-8b79-fc2192f488ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-11)", "content": "", "creation_timestamp": "2026-07-12T10:15:09.657278Z"}, {"uuid": "a34a17b2-a817-45ac-bf76-a1870561effb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-18)", "content": "", "creation_timestamp": "2026-07-19T10:15:11.598080Z"}, {"uuid": "33feffa3-f975-4940-8776-d39f4b5241e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/ibm_drm_download.rb", "content": "{\"actions\": [{\"description\": \"Download arbitrary file\", \"name\": \"Download\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"IBM Data Risk Manager (IDRM) contains two vulnerabilities that can be chained by\\n          an unauthenticated attacker to download arbitrary files off the system.\\n          The first is an unauthenticated bypass, followed by a path traversal.\\n          This module exploits both vulnerabilities, giving an attacker the ability to download (non-root) files.\\n          A downloaded file is zipped, and this module also unzips it before storing it in the database.\\n          By default this module downloads Tomcat's application.properties files, which contains the\\n          database password, amongst other sensitive data.\\n          At the time of disclosure, this is was a 0 day, but IBM later patched it and released their advisory.\\n          Versions 2.0.2 to 2.0.4 are vulnerable, version 2.0.1 is not.\", \"disclosure_date\": \"2020-04-21\", \"fullname\": \"auxiliary/admin/http/ibm_drm_download\", \"is_install_path\": true, \"mod_time\": \"2026-04-15 11:57:01 +0000\", \"name\": \"IBM Data Risk Manager Arbitrary File Download\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/http/ibm_drm_download.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/http/ibm_drm_download\", \"references\": [\"CVE-2020-4427\", \"CVE-2020-4429\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/IBM/ibm_drm/ibm_drm_rce.md\", \"URL-https://seclists.org/fulldisclosure/2020/Apr/33\", \"URL-https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-exist-in-ibm-data-risk-manager-cve-2020-4427-cve-2020-4428-cve-2020-4429-and-cve-2020-4430/\"], \"rport\": 8443, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:45.694847Z"}, {"uuid": "c0fcb85e-644d-4de6-801b-ebbfeb3777de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-4427", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ibm_drm_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"IBM Data Risk Manager (IDRM) contains three vulnerabilities that can be chained by\\n          an unauthenticated attacker to achieve remote code execution as root.\\n          The first is an unauthenticated bypass, followed by a command injection as the server user,\\n          and finally abuse of an insecure default password.\\n          This module exploits all three vulnerabilities, giving the attacker a root shell.\\n          At the time of disclosure this was an 0day, but it was later confirmed and patched by IBM.\\n          The authentication bypass works on versions <= 2.0.6.1, but the command injection should only work on\\n          versions <= 2.0.4 according to IBM.\", \"disclosure_date\": \"2020-04-21\", \"fullname\": \"exploit/linux/http/ibm_drm_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"IBM Data Risk Manager Unauthenticated Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/ibm_drm_rce.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/ibm_drm_rce\", \"references\": [\"CVE-2020-4427\", \"CVE-2020-4428\", \"CVE-2020-4429\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/IBM/ibm_drm/ibm_drm_rce.md\", \"URL-https://seclists.org/fulldisclosure/2020/Apr/33\", \"URL-https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-exist-in-ibm-data-risk-manager-cve-2020-4427-cve-2020-4428-cve-2020-4429-and-cve-2020-4430/\"], \"rport\": 8443, \"session_types\": false, \"targets\": [\"IBM Data Risk Manager <= 2.0.4\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:37.876474Z"}]}