CVE-2020-4450: 
IBM WebSphere App Server vulnerability analysis and mitigation

IBM WebSphere Application Server versions 8.5 and 9.0 traditional were found to contain a critical remote code execution vulnerability (CVE-2020-4450). The vulnerability was discovered by researcher tint0 working with Trend Micro Zero Day Initiative and Kylinking of NSFOCUS Security Team, and was disclosed on June 5, 2020. This security flaw affects the handling of the IIOP protocol in WebSphere Application Server traditional installations (ZDI Advisory, IBM Security Bulletin).

The vulnerability stems from improper validation of user-supplied data within the IIOP protocol handling, which can result in deserialization of untrusted data. It received a CVSS base score of 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that it can be exploited remotely with no authentication required and no user interaction needed (ZDI Advisory).

An attacker successfully exploiting this vulnerability could execute arbitrary code on the affected system with root privileges. The critical CVSS score of 9.8 indicates potential for complete compromise of system confidentiality, integrity, and availability (ZDI Advisory).

The vulnerability can be exploited remotely by sending a specially-crafted sequence of serialized objects to an affected WebSphere Application Server installation. No authentication is required to exploit this vulnerability, making it particularly dangerous (ZDI Advisory).

IBM has released fixes for affected versions. For WebSphere Application Server 9.0.0.0 through 9.0.5.4, users should either upgrade to Fix Pack 9.0.5.5 or later, or apply Interim Fix PH25074. For versions 8.5.0.0 through 8.5.5.17, users should either upgrade to Fix Pack 8.5.5.18 or later, or apply Interim Fix PH25074. No workarounds are available for this vulnerability (IBM Security Bulletin).