ID:2627 - Exploit for Improper Authentication in IBM Data Risk Manager - CVE-2020-4428

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to sensitive information exposure at the "/albatross/saml/idpSelection" API endpoint that provides unauthenticated users with a valid session identifier. A remote non-authenticated attacker can obtain session identifier, bypass authentication process and gain unauthorized access to the application.

Remediation