CVE-2023-25923 — Incorrect Authorization in IBM Security KEY Lifecycle Manager

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
7.5HIGHNVD
CNA2.7
EPSS
0.3%
top 42.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Security KEY Lifecycle Manager
Timeline
PublishedMar 21

Description

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service attack due to incorrect authorization. IBM X-Force ID: 247629.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ibm/security_key_lifecycle_manager3.0, 3.0.1, 4.0, 4.1, 4.1.1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
CVEList
IBM Security Key Lifecycle Manager denial of service↗2023-03-21
▶
GHSA
GHSA-3887-7vpg-g78m: IBM Security Guardium Key Lifecycle Manager 3↗2023-03-21
▶
CVE-2023-25923 — Incorrect Authorization in IBM | cvebase