Lucene search

IBMB7A26CD3AEFDB5C88AA18C7A6CE254C0958F5815CBBA857D058C73D8B6ECEBB9

HistoryOct 31, 2023 - 4:48 p.m.

Security Bulletin: IBM Security Guardium is affected by a Command injection in CLI vulnerability [CVE-2023-35893]

2023-10-3116:48:36

www.ibm.com

ibm security guardium

command injection

cve-2023-35893

10.6

11.3

11.4

11.5

fix

vulnerability

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.1%

JSON

Summary

IBM Security Guardium has addressed these vulnerabilities [CVE-2023-35893]

Vulnerability Details

CVEID:CVE-2023-35893
**DESCRIPTION:**IBM Security Guardium could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
CVSS Base score: 9.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/258824 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Security Guardium	10.6
IBM Security Guardium	11.3
IBM Security Guardium	11.4
IBM Security Guardium	11.5

Remediation/Fixes

IBM encourages customers to update their systems promptly.

Product	Versions	Fix
IBM Security Guardium	10.6	https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=10.0&platform=Linux&function=fixId&fixids=SqlGuard_10.0p1030_Bundle_Oct-03-2023&includeSupersedes=0&source=fc
IBM Security Guardium	11.3	https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p387_Security-Fix&includeSupersedes=0&source=fc
IBM Security Guardium	11.4	https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p6401_October-Security-Patch_V11.4&includeSupersedes=0&source=fc
IBM Security Guardium	11.5

https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p6501_October-Security-Patch_V11.5&includeSupersedes=0&source=fc

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsecurity_guardiumMatch10.6

ibmsecurity_guardiumMatch11.3

ibmsecurity_guardiumMatch11.4

ibmsecurity_guardiumMatch11.5

CPENameOperatorVersion
ibm security guardiumeq10.6
ibm security guardiumeq11.3
ibm security guardiumeq11.4
ibm security guardiumeq11.5

Name	Operator	Version
ibm security guardium	eq	10.6
ibm security guardium	eq	11.3
ibm security guardium	eq	11.4
ibm security guardium	eq	11.5

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.1%

JSON

Related for B7A26CD3AEFDB5C88AA18C7A6CE254C0958F5815CBBA857D058C73D8B6ECEBB9