Information Disclosure Vulnerability in IBM Tivoli Key Lifecycle Manager
CVE-2021-38978
5.9MEDIUM
Summary
The IBM Tivoli Key Lifecycle Manager is vulnerable to an information disclosure issue caused by improper enforcement of HTTP Strict Transport Security (HSTS). This vulnerability allows remote attackers to leverage man-in-the-middle techniques to intercept and retrieve sensitive information transmitted by the application. Organizations using the affected versions should prioritize applying the relevant security patches to mitigate the risk of unauthorized data access.
Affected Version(s)
Security Key Lifecycle Manager 3.0
Security Key Lifecycle Manager 3.0.1
Security Key Lifecycle Manager 4.0
References
CVSS V3.1
Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved