PT-2021-3156 · Ibm · Ibm Security Guardium

Published 2021-05-21 · Updated 2021-05-25 · CVE-2021-20385

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Security Guardium version 11.2

Description The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially-crafted request. This could enable an attacker to exploit the vulnerability and execute arbitrary commands on the system, potentially impacting the confidentiality, integrity, and availability of protected information.

Recommendations For IBM Security Guardium version 11.2, consider restricting access to the system until a patch is available, and avoid using the system for sensitive operations. As a temporary workaround, consider disabling any functionality that allows remote authenticated attackers to send specially-crafted requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-02826

CVE-2021-20385

Affected Products

Ibm Security Guardium

References · 8

• https://ibm.com/support/pages/node/6455281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20385 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/195766 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02826 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20385 · Vendor Advisory
• https://ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-affected-by-multiple-vulnerabilities-4 · Note
• https://t.me/cvenotify/15010 · Telegram Post
• https://t.me/cvenotify/14926 · Telegram Post