CVE-2024-49817

CWE-260CWE-522 — Insufficiently Protected Credentials3 documents3 sources
Severity
4.4MEDIUM
EPSS
0.0%
top 90.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Security Guardium KEY Lifecycle Manager
Timeline
PublishedDec 17

Description

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores user credentials in configuration files which can be read by a local privileged user.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 0.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ibm/security_guardium_key_lifecycle_manager4.1, 4.1.1, 4.2.0, 4.2.1

🔴Vulnerability Details

2
CVEList
IBM Security Guardium Key Lifecycle Manager information disclosure↗2024-12-17
▶
GHSA
GHSA-p986-vg8j-hhh7: IBM Security Guardium Key Lifecycle Manager 4↗2024-12-17
▶
CVE-2024-49817 (MEDIUM CVSS 4.4) | IBM Security Guardium Key Lifecycle | cvebase.io