CVE-2020-4987

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-04 · updated 2026-06-17
Weakness: CWE-79

Description

The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and prior and 1.6.1.2 and prior. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected products

IBM FlashSystem 900: before 1.5.2.9; from 1.6.0.0 before 1.6.1.3 — fixed in 1.5.2.9, 1.6.1.3

How to fix

Upgrade to a fixed version: IBM FlashSystem 900 1.5.2.9, 1.6.1.3. Check the vendor advisory for mitigations.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/192702
https://www.ibm.com/support/pages/node/6449280
https://exchange.xforce.ibmcloud.com/vulnerabilities/192702
https://www.ibm.com/support/pages/node/6449280

Get alerted when CVE-2020-4987 or the next vulnerability affects your stack