CVE-2023-25925 IBM Security Guardium Key Lifecycle Manager command injection
Remote authenticated attackers can execute arbitrary commands on IBM Security Guardium Key Lifecycle Manager via crafted requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-25925?
CVE-2023-25925 is a high-severity command injection vulnerability in IBM Security Guardium Key Lifecycle Manager, published on 28 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 247632.
Weakness: CWE-78
Which versions are affected by CVE-2023-25925?
It affects 1 product.
Products include Ibm Security Guardium Key Lifecycle Manager.
How do I fix CVE-2023-25925?
No fix has been published for CVE-2023-25925 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-25925 being exploited?
There is no known exploitation of CVE-2023-25925 in the wild and no public exploit code.
Other vulnerabilities in IBM Security Guardium Key Lifecycle Manager
- CVE-2023-25921 IBM Security Guardium Key Lifecycle Manager file upload
- CVE-2023-47706 IBM Security Guardium Key Lifecycle Manager file upload
- CVE-2021-38976 Hardcoded credentials in Security Key Lifecycle Manager
- CVE-2021-38978 Information disclosure in Security Key Lifecycle Manager
- CVE-2023-25926 IBM Security Guardium Key Lifecycle Manager XML external entity injection
Sources
Also known as GHSA-h9v6-x8w6-frrm.