Skip to content
OpenAdvisories
Medium WID-SEC-2023-3186 6 CVEs

IBM Security Guardium: Mehrere Schwachstellen

Published Dec 19, 2023 · Updated Dec 19, 2023 · de-DE

Vendor: IBM Product: Security Guardium Key Lifecycle Manager 4.2 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in IBM Security Guardium ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Daten zu manipulieren und einen Cross Site Scripting Angriff durchzuführen.

Product

IBM Security Guardium ist eine Lösung für die Überwachung und Auditierung des Datenzugriffs.

Vulnerabilities 6

  • Medium 6.6
    CVE-2023-47706

    IBM Security Guardium Key Lifecycle Manager file upload

    IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type. IBM X-Force ID: 271341.

    IBM Security Guardium Key Lifecycle Manager
  • Medium 5.4
    CVE-2023-47707

    IBM Security Guardium Key Lifecycle Manager cross-site scripting

    IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with…

    IBM Security Guardium Key Lifecycle Manager
  • Medium 5.3
    CVE-2023-47703

    IBM Security Guardium Key Lifecycle Manager information disclosure

    IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force…

    IBM Security Guardium Key Lifecycle Manager
  • Medium 4.3
    CVE-2023-47702

    IBM Security Guardium Key Lifecycle Manager directory traversal

    IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view modify files on the system. IBM X-Force I…

    IBM Security Guardium Key Lifecycle Manager
  • Medium 4.3
    CVE-2023-47705

    IBM Security Guardium Key Lifecycle Manager improper input validation

    IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation. IBM X-Force ID: 271228.

    IBM Security Guardium Key Lifecycle Manager
  • Medium 4.0
    CVE-2023-47704

    IBM Security Guardium Key Lifecycle Manager information disclosure

    IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220.

    IBM Security Guardium Key Lifecycle Manager

Revision history

  1. #1

    Initiale Fassung

References