CVE-2023-25926

2024-02-2901:38:24

CWE-611

[email protected]

web.nvd.nist.gov

ibm

security guardium

key lifecycle manager

xml

external entity injection

xxe

vulnerability

5.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 247599.

Affected configurations

Vulners

Node

ibmsecurity_guardium_key_lifecycle_managerMatch3.0

ibmsecurity_guardium_key_lifecycle_managerMatch3.0.1

ibmsecurity_guardium_key_lifecycle_managerMatch4.0

ibmsecurity_guardium_key_lifecycle_managerMatch4.1

ibmsecurity_guardium_key_lifecycle_managerMatch4.1.1

VendorProductVersionCPE
ibmsecurity_guardium_key_lifecycle_manager3.0cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:3.0:*:*:*:*:*:*:*
ibmsecurity_guardium_key_lifecycle_manager3.0.1cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:3.0.1:*:*:*:*:*:*:*
ibmsecurity_guardium_key_lifecycle_manager4.0cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.0:*:*:*:*:*:*:*
ibmsecurity_guardium_key_lifecycle_manager4.1cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1:*:*:*:*:*:*:*
ibmsecurity_guardium_key_lifecycle_manager4.1.1cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	security_guardium_key_lifecycle_manager	3.0	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:3.0:::::::*
ibm	security_guardium_key_lifecycle_manager	3.0.1	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:3.0.1:::::::*
ibm	security_guardium_key_lifecycle_manager	4.0	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.0:::::::*
ibm	security_guardium_key_lifecycle_manager	4.1	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1:::::::*
ibm	security_guardium_key_lifecycle_manager	4.1.1	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.1:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Security Guardium Key Lifecycle Manager",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "3.0, 3.0.1, 4.0, 4.1, 4.1.1"
      }
    ]
  }
]