by Kastro
Paper/Archive/CVE-2023-26270

CVE-2023-26270

IBM Guardium Cloud Key Manager — IBM Security Guardium Data Encryption code execution

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.1.531 × 2010.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to execute arbitrary code on the system, caused by an angular template injection flaw. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 248119.

Affected

ProductAffectedFixed inSource
Guardium Cloud Key Manager1.10.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ibm (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisoryibm.com/support/pages/node/6995161refexchange.xforce.ibmcloud.com/vulnerabilities/248119