IBMA03712C27BD89E132D38B35056DEE23D9C762A235EA592F1FD28997F18FBD69FSecurity Bulletin: Vulnerability CVE-2021-39024 in IBM Guardium Data Encryption (GDE)
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
25.0%
Summary
Vulnerability identified in IBM Guardium Data Encryption (GDE). Please apply the latest version for the fixes.
Vulnerability Details
CVEID:CVE-2021-39024
**DESCRIPTION:**IBM Guardium Data Encryption (GDE) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 4.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213862 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Affected Products and Versions
| Product Name | Component Name | Affected Version |
|---|---|---|
| IBM Guardium Data Encryption (GDE) | Guardium Data Encryption Server (CipherTrust Manager ) | CM 2.6 |
Remediation/Fixes
Please apply the fix from below links, to obtain the fixes.
Note: In order to get the fix, customer needs to login to Thales portal.
| Component Name | Fixed in version | Patch/Upgrade link |
|---|---|---|
| Guardium Data Encryption Server (CipherTrust Manager ) | GDE 5.0.0.5 (CM 2.8) | https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=256ec2b987d389547b0664e80cbb3572&sysparm_article=KB0025847 |
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm security guardium data encryption | eq | 4.0.0. | |
| ibm security guardium data encryption | eq | 5.0.0. |
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
25.0%