CVE-2020-4409: ibm control_desk Open Redirect
Vulnerability summary
CVE-2020-4409 is a high (CVSS 8.2) Open Redirect vulnerability in ibm control_desk. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 58.8% of scored vulnerabilities.
Timeline
- 16-09-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 179537.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST6.8MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
EPSS trend
Probability
0.89%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
0.00 pp
From 0.89% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ibm20 products
- control_desk7.6.1 | 7.6.1.1
- maximo_asset_configuration_manager7.6.6 | 7.6.7 | 7.6.7.1
- maximo_asset_health_insights7.6.1 | 7.6.1.1
- maximo_asset_management7.6.0 | 7.6.1 | < 7.6.1.2
- maximo_asset_management_scheduler7.6.7 | 7.6.7.1 | 7.6.7.3
1 vendor · 20 products