PT-2018-14022 · Ibm · Ibm Tivoli Key Lifecycle Manager

Chris Shepherd + 5 · Published 2018-10-08 · Updated 2019-10-09 · CVE-2018-1742

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager versions 2.6 through 3.0

Description The issue concerns hard-coded credentials, such as a password or cryptographic key, used for inbound authentication, outbound communication to external components, or encryption of internal data.

Recommendations For versions 2.6 through 3.0, update the software to remove the hard-coded credentials, replacing them with secure, configurable authentication mechanisms.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-1742

Affected Products

Ibm Tivoli Key Lifecycle Manager

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/148421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1742 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1742 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=ibm10733419 · Vendor Advisory