CVE-2023-25921
Assigner: ibm
Published: 2024-02-29T00:36:01.872Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Security Guardium Key Lifecycle Manager
vendor: IBM
versions: status: affected
version: 3.0, 3.0.1, 4.0, 4.1, 4.1.1
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247620.</span>


value: 
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247620.


metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
type: CWE
source: discovery: UNKNOWN
title: IBM Security Guardium Key Lifecycle Manager file upload
x_generator: engine: Vulnogram 0.1.0-dev