CVE-2023-25922

CWE-434 — Unrestricted File Upload3 documents3 sources
Severity
8.8HIGH
EPSS
0.1%
top 81.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Security Guardium KEY Lifecycle Manager
Timeline
PublishedFeb 28
Latest updateFeb 29

Description

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247621.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5ibm/security_guardium_key_lifecycle_manager3.0, 3.0.1, 4.0, 4.1, 4.1.1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-p822-5pxq-5x9h: IBM Security Guardium Key Lifecycle Manager 3↗2024-02-29
▶
CVEList
IBM Security Guardium Key Lifecycle Manager file upload↗2024-02-28
▶
CVE-2023-25922 (HIGH CVSS 8.8) | IBM Security Guardium Key Lifecycle | cvebase.io