PT-2021-3174 · Ibm · Ibm Security Guardium

Published 2021-05-21 · Updated 2021-05-25 · CVE-2021-20426

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Security Guardium version 11.2

Description The issue is related to hard-coded credentials, such as a password or cryptographic key, used by IBM Security Guardium for its own inbound authentication, outbound communication to external components, or encryption of internal data. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For IBM Security Guardium version 11.2, consider changing the hard-coded credentials to unique, secure values to prevent unauthorized access. As a temporary workaround, restrict access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2021-02846

CVE-2021-20426

Affected Products

Ibm Security Guardium

References · 7

• https://ibm.com/support/pages/node/6455281 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02846 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-20426 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/196313 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20426 · Vendor Advisory
• https://t.me/cvenotify/14922 · Telegram Post
• https://ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-affected-by-multiple-vulnerabilities-4 · Note