Vulnerability-Lookup

CNVD-2023-20078

Vulnerability from cnvd - Published: 2023-03-27

Title

IBM Security Guardium Key Lifecycle Manager未授权访问漏洞

Description

IBM Security Guardium Key ifecycle Manager是管理通过集中化、精简化和自动化来进行加密密钥管理流程，以帮助保护加密数据和简化加密密钥管理。 IBM Security Guardium Key Lifecycle Manager存在未授权访问漏洞。该漏洞是由于受影响版本可以允许经过身份验证的用户进行越权访问操作。攻击者可利用该漏洞对目标有针对性的发起攻击，危害站点系统安全。

Severity

中

Patch Name

IBM Security Guardium Key Lifecycle Manager未授权访问漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新: https://exchange.xforce.ibmcloud.com/vulnerabilities/247630

Reference

https://nvd.nist.gov/vuln/detail/CVE-2023-25924

Impacted products

Name
['IBM Security Guardium Key Lifecycle Manager 3.0', 'IBM Security Guardium Key Lifecycle Manager 3.0.1', 'IBM Security Guardium Key Lifecycle Manager 4.0', 'IBM Security Guardium Key Lifecycle Manager 4.1', 'IBM Security Guardium Key Lifecycle Manager 4.1.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-25924",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-25924"
    }
  },
  "description": "IBM Security Guardium Key ifecycle Manager\u662f\u7ba1\u7406\u901a\u8fc7\u96c6\u4e2d\u5316\u3001\u7cbe\u7b80\u5316\u548c\u81ea\u52a8\u5316\u6765\u8fdb\u884c\u52a0\u5bc6\u5bc6\u94a5\u7ba1\u7406\u6d41\u7a0b\uff0c\u4ee5\u5e2e\u52a9\u4fdd\u62a4\u52a0\u5bc6\u6570\u636e\u548c\u7b80\u5316\u52a0\u5bc6\u5bc6\u94a5\u7ba1\u7406\u3002\n\nIBM Security Guardium Key Lifecycle Manager\u5b58\u5728\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u53d7\u5f71\u54cd\u7248\u672c\u53ef\u4ee5\u5141\u8bb8\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u7528\u6237\u8fdb\u884c\u8d8a\u6743\u8bbf\u95ee\u64cd\u4f5c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u76ee\u6807\u6709\u9488\u5bf9\u6027\u7684\u53d1\u8d77\u653b\u51fb\uff0c\u5371\u5bb3\u7ad9\u70b9\u7cfb\u7edf\u5b89\u5168\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0:\r\nhttps://exchange.xforce.ibmcloud.com/vulnerabilities/247630",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-20078",
  "openTime": "2023-03-27",
  "patchDescription": "IBM Security Guardium Key ifecycle Manager\u662f\u7ba1\u7406\u901a\u8fc7\u96c6\u4e2d\u5316\u3001\u7cbe\u7b80\u5316\u548c\u81ea\u52a8\u5316\u6765\u8fdb\u884c\u52a0\u5bc6\u5bc6\u94a5\u7ba1\u7406\u6d41\u7a0b\uff0c\u4ee5\u5e2e\u52a9\u4fdd\u62a4\u52a0\u5bc6\u6570\u636e\u548c\u7b80\u5316\u52a0\u5bc6\u5bc6\u94a5\u7ba1\u7406\u3002\r\n\r\nIBM Security Guardium Key Lifecycle Manager\u5b58\u5728\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u53d7\u5f71\u54cd\u7248\u672c\u53ef\u4ee5\u5141\u8bb8\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u7528\u6237\u8fdb\u884c\u8d8a\u6743\u8bbf\u95ee\u64cd\u4f5c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u76ee\u6807\u6709\u9488\u5bf9\u6027\u7684\u53d1\u8d77\u653b\u51fb\uff0c\u5371\u5bb3\u7ad9\u70b9\u7cfb\u7edf\u5b89\u5168\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Security Guardium Key Lifecycle Manager\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Security Guardium Key Lifecycle Manager 3.0",
      "IBM Security Guardium Key Lifecycle Manager 3.0.1",
      "IBM Security Guardium Key Lifecycle Manager 4.0",
      "IBM Security Guardium Key Lifecycle Manager 4.1",
      "IBM Security Guardium Key Lifecycle Manager 4.1.1"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-25924",
  "serverity": "\u4e2d",
  "submitTime": "2023-03-24",
  "title": "IBM Security Guardium Key Lifecycle Manager\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e"
}

CVE-2023-25924 (GCVE-0-2023-25924)

Vulnerability from cvelistv5 – Published: 2023-03-21 14:53 – Updated: 2025-02-26 16:48

Title

IBM Security Key Lifecycle Manager improper authorization

Summary

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

ibm

References

URL

Tags

	https://www.ibm.com/support/pages/node/6962729	vendor-advisory
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entry

Impacted products

	Vendor	Product	Version
	IBM	Security Key Lifecycle Manager	Affected: 3.0, 3.0.1, 4.0, 4.1 , 4.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:32:12.755Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/6962729"
          },
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247630"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-25924",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-26T16:48:08.214652Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-26T16:48:20.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Security Key Lifecycle Manager",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "3.0, 3.0.1, 4.0, 4.1 , 4.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization.  IBM X-Force ID:  247630."
            }
          ],
          "value": "IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization.  IBM X-Force ID:  247630."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-22T04:39:15.803Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/6962729"
        },
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247630"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Security Key Lifecycle Manager improper authorization",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2023-25924",
    "datePublished": "2023-03-21T14:53:38.493Z",
    "dateReserved": "2023-02-16T16:39:45.212Z",
    "dateUpdated": "2025-02-26T16:48:20.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2023-20078

CVE-2023-25924 (GCVE-0-2023-25924)

Tags

Sightings

Nomenclature