PT-2022-10846 · Ibm · Ibm Guardium Data Encryption

Ben Goodspeed + 8 · Published 2022-03-10 · Updated 2022-03-22 · CVE-2021-39022

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Encryption (GDE) versions 4.0.0.0 through 5.0.0.0

Description The issue arises when user-provided information is saved into a Comma-Separated Value (CSV) file without properly neutralizing special elements. These elements could be interpreted as commands when the file is opened by spreadsheet software.

Recommendations For versions 4.0.0.0 and 5.0.0.0, consider disabling the feature that saves user-provided information into CSV files until a proper fix is available. Restrict access to the CSV files generated by the software to minimize the risk of exploitation. Avoid opening these files with spreadsheet software that could interpret special elements as commands. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2021-39022

Affected Products

Ibm Guardium Data Encryption

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-39022 · Security Note
• https://ibm.com/support/pages/node/6562379 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/213858 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39022 · Vendor Advisory
• https://t.me/cibsecurity/38734 · Telegram Post