Information Disclosure Vulnerability in IBM Tivoli Key Lifecycle Manager
CVE-2021-38978

5.9MEDIUM

Key Information:

Vendor

IBM
Status
Security Key Lifecycle Manager
Vendor
CVE Published:
15 November 2021

What is CVE-2021-38978?

The IBM Tivoli Key Lifecycle Manager is vulnerable to an information disclosure issue caused by improper enforcement of HTTP Strict Transport Security (HSTS). This vulnerability allows remote attackers to leverage man-in-the-middle techniques to intercept and retrieve sensitive information transmitted by the application. Organizations using the affected versions should prioritize applying the relevant security patches to mitigate the risk of unauthorized data access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Security Key Lifecycle Manager 3.0

Security Key Lifecycle Manager 3.0.1

Security Key Lifecycle Manager 4.0

References

https://www.ibm.com/support/pages/node/6516050
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/212783
vdb-entryx_refsource_XF

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.