PT-2021-22346 · Ibm · Ibm Security Guardium Key Lifecycle Manager+1

Ben Goodspeed + 8 · Published 2021-11-23 · Updated 2021-11-24 · CVE-2021-38980

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) versions 3.0 through 4.1

Description A remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser, potentially using this information for further attacks against the system.

Recommendations For versions 3.0 through 4.1, consider restricting access to detailed technical error messages to minimize the risk of exploitation. As a temporary workaround, limit the information returned in browser error messages until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2021-38980

Affected Products

Ibm Security Guardium Key Lifecycle Manager

Ibm Tivoli Key Lifecycle Manager

References · 5

• https://ibm.com/support/pages/node/6518326 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38980 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/212786 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38980 · Security Note
• https://t.me/cibsecurity/32882 · Telegram Post