IBM Security Guardium Key Lifecycle Manager Vulnerable to XML External Entity Injection Attack
CVE-2023-25926

8.2HIGH

Key Information:

Vendor

IBM
Status
Security Guardium Key Lifecycle Manager
Vendor
CVE Published:
29 February 2024

What is CVE-2023-25926?

IBM Security Guardium Key Lifecycle Manager is susceptible to an XML External Entity Injection vulnerability that occurs during the processing of XML data. This vulnerability allows a remote attacker to manipulate XML content in such a way that it can result in the exposure of sensitive information or excessive consumption of memory resources. Such exploitation could lead to further attacks or unauthorized access, impacting the confidentiality and integrity of the system's data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, 4.1.1

References

https://www.ibm.com/support/pages/node/6964516
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/247599

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.