Lucene search

IBM9F36B8FE4109F9399915944CA94E10F453C2503E5DCC32BC217D129C932E883A

HistoryDec 21, 2023 - 3:45 p.m.

Security Bulletin: IBM Security Guardium is affected by a CSV Injection vulnerability (CVE-2023-42004)

2023-12-2115:45:54

www.ibm.com

ibm security guardium

csv injection

remote attacker

system updates

vulnerable versions

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.4%

JSON

Summary

IBM Security Guardium has addressed this vulnerability in an update.

Vulnerability Details

CVEID:CVE-2023-42004
**DESCRIPTION:**IBM Security Guardium is potentially vulnerable to CSV injection. A remote attacker could execute malicious commands due to improper validation of csv file contents.
CVSS Base score: 8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/265262 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Security Guardium	11.3
IBM Security Guardium	11.4
IBM Security Guardium	11.5
BM Security Guardium	12.0

Remediation/Fixes

IBM encourages customers to update their systems promptly.

Product	Versions	Fix
IBM Security Guardium	11.3	https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p6301_October-Security-Patch_V11.3&includeSupersedes=0&source=fc
IBM Security Guardium	11.4	https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p6401_October-Security-Patch_V11.4&includeSupersedes=0&source=fc
IBM Security Guardium	11.5	https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p6501_October-Security-Patch_V11.5&includeSupersedes=0&source=fc
BM Security Guardium	12.0	https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.0&platform=Linux&function=fixId&fixids=SqlGuard_12.0p6002_November-Security-Patch_V12.0&includeSupersedes=0&source=fc

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsecurity_guardiumMatch11.3

ibmsecurity_guardiumMatch11.4

ibmsecurity_guardiumMatch11.5

ibmsecurity_guardiumMatch12.0

CPENameOperatorVersion
ibm security guardiumeq11.3
ibm security guardiumeq11.4
ibm security guardiumeq11.5
ibm security guardiumeq12.0

Name	Operator	Version
ibm security guardium	eq	11.3
ibm security guardium	eq	11.4
ibm security guardium	eq	11.5
ibm security guardium	eq	12.0

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.4%

JSON

Related for 9F36B8FE4109F9399915944CA94E10F453C2503E5DCC32BC217D129C932E883A