Skip to content
OpenAdvisories
Medium WID-SEC-2023-0713 7 CVEs

IBM Security Guardium Key Lifecycle Manager: Mehrere Schwachstellen

Published Mar 21, 2023 · Updated Mar 21, 2023 · de-DE

Vendor: IBM Product: Security Guardium Product: Security Guardium Key Lifecycle Manager 4.0 Product: Security Guardium Key Lifecycle Manager 4.1 Product: Security Guardium Key Lifecycle Manager 4.1.1 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in IBM Security Guardium Key Lifecycle Manager ausnutzen, um Dateien zu manipulieren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.

Product

IBM Security Guardium ist eine Lösung für die Überwachung und Auditierung des Datenzugriffs.

Vulnerabilities 7

  • Medium 6.5
    CVE-2023-25684

    IBM Security Key Lifecycle Manager SQL injection

    IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-en…

    IBM Security Key Lifecycle Manager
  • Medium 6.2
    CVE-2023-25686

    IBM Security Key Lifecycle Manager information disclosure

    IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 247601.

    IBM Security Key Lifecycle Manager
  • Medium 5.4
    CVE-2023-25924

    IBM Security Key Lifecycle Manager improper authorization

    IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630.

    IBM Security Key Lifecycle Manager
  • Medium 4.3
    CVE-2023-25687

    IBM Security Key Lifecycle Manager information disclosure

    IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files. IBM X-Force ID: 247602.

    IBM Security Key Lifecycle Manager
  • Medium 4.3
    CVE-2023-25688

    IBM Security Key Lifecycle Manager information disclosure

    IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary file…

    IBM Security Key Lifecycle Manager
  • Low 2.7
    CVE-2023-25689

    IBM Security Key Lifecycle Manager information disclosure

    IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1 , and 4.1.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary fi…

    IBM Security Key Lifecycle Manager
  • Low 2.7
    CVE-2023-25923

    IBM Security Key Lifecycle Manager denial of service

    IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service attack due to incorrect authorization. IBM X-Force ID: 247629.

    IBM Security Key Lifecycle Manager

Revision history

  1. #1

    Initiale Fassung

References