Information Disclosure Vulnerability in IBM Tivoli Key Lifecycle Manager
CVE-2021-38978

5.9MEDIUM

Key Information:

Vendor
IBM
Status
Security Key Lifecycle Manager
Vendor
CVE Published:
15 November 2021

Summary

The IBM Tivoli Key Lifecycle Manager is vulnerable to an information disclosure issue caused by improper enforcement of HTTP Strict Transport Security (HSTS). This vulnerability allows remote attackers to leverage man-in-the-middle techniques to intercept and retrieve sensitive information transmitted by the application. Organizations using the affected versions should prioritize applying the relevant security patches to mitigate the risk of unauthorized data access.

Affected Version(s)

Security Key Lifecycle Manager 3.0

Security Key Lifecycle Manager 3.0.1

Security Key Lifecycle Manager 4.0

References

https://www.ibm.com/support/pages/node/6516050
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/212783
vdb-entryx_refsource_XF

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.