CVE-2012-3338 Missing authorization in InfoSphere Guardium

What is CVE-2012-3338?

CVE-2012-3338 is a low-severity missing authorization vulnerability in IBM InfoSphere Guardium, published on 1 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by improper restrictions on the create new user account functionality. An attacker could exploit this vulnerability to create unprivileged user accounts. IBM X-Force ID: 78286.

Weakness: CWE-20

Which versions are affected by CVE-2012-3338?

It affects 1 product.

Products include Ibm Infosphere Guardium.

How do I fix CVE-2012-3338?

No fix has been published for CVE-2012-3338 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2012-3338 being exploited?

There is no known exploitation of CVE-2012-3338 in the wild and no public exploit code.

Other vulnerabilities in IBM InfoSphere Guardium

• CVE-2013-0490 Privilege escalation in n/a High 7.2
• CVE-2012-3309 Cross-site request forgery in n/a Medium 6.8
• CVE-2012-3341 Cross-site scripting in InfoSphere Guardium Medium 6.4
• CVE-2012-3336 SQL injection in InfoSphere Guardium Medium 6.3
• CVE-2012-2204 InfoSphere Guardium aix_ktap module: DoS Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4qcx-6j6m-v9pj.