CVE-2023-25921 — Unrestricted File Upload in IBM Security Guardium KEY Lifecycle Manager

CWE-434 — Unrestricted File Upload3 documents3 sources
Severity
8.8HIGHNVD
CNA8.5
EPSS
0.1%
top 74.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Security Guardium KEY Lifecycle Manager
Timeline
PublishedFeb 29

Description

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247620.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5ibm/security_guardium_key_lifecycle_manager3.0, 3.0.1, 4.0, 4.1, 4.1.1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
CVEList
IBM Security Guardium Key Lifecycle Manager file upload↗2024-02-29
▶
GHSA
GHSA-57c7-52jj-89fr: IBM Security Guardium Key Lifecycle Manager 3↗2024-02-29
▶
CVE-2023-25921 — Unrestricted File Upload in IBM | cvebase