Information disclosure in Financial Transaction Manager for High Value Payments - CVE-2020-4556

Vulnerability identifier: #VU82072

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-4556

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to web pages stored locally. A local user can gain unauthorized access to sensitive information on the system.

Financial Transaction Manager for High Value Payments
Financial Transaction Manager for Corporate Payment Services (CPS)
Financial Transaction Manager for Digital Payments (DP)

Install updates from vendor's website.

Financial Transaction Manager for High Value Payments - update to 3.2.11
Financial Transaction Manager for Corporate Payment Services (CPS) - update to 3.2.10
Financial Transaction Manager for Digital Payments (DP) - update to 3.2.10

• https://exchange.xforce.ibmcloud.com/vulnerabilities/183329
• https://www.ibm.com/support/pages/node/6962117

• Multiple vulnerabilities in IBM Financial Transaction Manager for Digital Payments, High Value Payments and Corporate Payment Services