CVE-2023-25925: IBM Security Guardium Key Lifecycle Manager command injection
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 247632.
Other sources
IBM Security Guardium Key Lifecycle Manager could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-25925?
CVE-2023-25925 is classified as a critical vulnerability that allows remote authenticated attackers to execute arbitrary commands.
How do I fix CVE-2023-25925?
To fix CVE-2023-25925, upgrade your IBM Security Guardium Key Lifecycle Manager to version 4.1.1.6 or later.
What versions of IBM Security Guardium Key Lifecycle Manager are affected by CVE-2023-25925?
CVE-2023-25925 affects versions 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 of IBM Security Guardium Key Lifecycle Manager.
Can unprivileged users exploit CVE-2023-25925?
Yes, CVE-2023-25925 can be exploited by remote authenticated attackers, potentially including unprivileged users.
What are the potential impacts of CVE-2023-25925?
The potential impacts of CVE-2023-25925 include unauthorized command execution which may compromise the integrity and confidentiality of the system.