How severe is CVE-2020-4138?

CVE-2020-4138 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2020-4138 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-4138?

CVE-2020-4138 affects Ibm Security Siteprotector System. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-4138?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-4138 published?

CVE-2020-4138 was published on 2022-07-11 and last updated on 2026-06-17.

CVE-2020-4138

CVE-2020-4138 is a medium-severity vulnerability in Ibm Security Siteprotector System with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 2.1
EPSS exploit prediction: 0% (13th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Ibm Security Siteprotector System
Published: 2022-07-11
Last modified: 2026-06-17

Description

IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174049.

Frequently asked questions

What is CVE-2020-4138?: IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174049.
How severe is CVE-2020-4138?: CVE-2020-4138 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2020-4138 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-4138?: CVE-2020-4138 affects Ibm Security Siteprotector System. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-4138?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-4138 published?: CVE-2020-4138 was published on 2022-07-11 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:ibm:security_siteprotector_system:3.1.1:*:*:*:*:*:*:*

More vulnerabilities in Ibm Security Siteprotector System

CVE-2020-4150 — Critical (CVSS 9.8): IBM SiteProtector Appliance 3.1.1 contains hard-coded credentials, such as a password or cryptographic key, which it…
CVE-2015-0160 — Critical (CVSS 9.0): IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote…
CVE-2015-0172 — High (CVSS 7.5): IBM Security SiteProtector System 3.0, 3.1.0 and 3.1.1 allows remote attackers to bypass intended security restrictions…
CVE-2015-0162 — High (CVSS 7.0): IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.
CVE-2015-0161 — Medium (CVSS 6.5): SQL injection vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1…
CVE-2015-0171 — Medium (CVSS 5.5): Directory traversal vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and…

All CVEs affecting Ibm Security Siteprotector System →