IBM Security Guardium Key Lifecycle Manager up to 4.1.1 Request os command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in IBM Security Guardium Key Lifecycle Manager 3.0/3.0.1/4.0/4.1/4.1.1. The impacted element is an unknown function of the component Request Handler. Performing a manipulation results in os command injection. This vulnerability is reported as CVE-2023-25925. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in IBM Security Guardium Key Lifecycle Manager 3.0/3.0.1/4.0/4.1/4.1.1 (Policy Management Software). This affects an unknown functionality of the component Request Handler. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 247632.

The weakness was disclosed 02/29/2024. It is possible to read the advisory at ibm.com. This vulnerability is uniquely identified as CVE-2023-25925 since 02/16/2023. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/13/2024). It is expected to see the exploit prices for this product increasing in the near future.The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (247632). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Policy Management Software

Vendor

• IBM

Name

• Security Guardium Key Lifecycle Manager

Version

• 3.0
• 3.0.1
• 4.0
• 4.1
• 4.1.1

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion