IBM Security Guardium Key Lifecycle Manager up to 4.1.1 URL Request path traversal

Summaryinfo

A vulnerability classified as critical has been found in IBM Security Guardium Key Lifecycle Manager 3.0/3.0.1/4.0/4.1/4.1.1. Affected by this vulnerability is an unknown functionality of the component URL Request Handler. Performing a manipulation results in path traversal. This vulnerability is cataloged as CVE-2023-25688. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in IBM Security Guardium Key Lifecycle Manager 3.0/3.0.1/4.0/4.1/4.1.1 (Policy Management Software). This affects some unknown processing of the component URL Request Handler. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality. The summary by CVE is:

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 247606.

The weakness was shared 03/22/2023. The advisory is shared at ibm.com. This vulnerability is uniquely identified as CVE-2023-25688 since 02/11/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (247606). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Policy Management Software

Vendor

• IBM

Name

• Security Guardium Key Lifecycle Manager

Version

• 3.0
• 3.0.1
• 4.0
• 4.1
• 4.1.1

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion