PT-2023-6904 · Ibm · Ibm Security Guardium

Published 2023-08-27 · Updated 2023-09-19 · CVE-2023-33852

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Security Guardium version 11.4

Description The issue is related to SQL injection, where a remote attacker could send specially crafted SQL statements to view, add, modify, or delete information in the back-end database. This is due to the lack of protection measures for the SQL query structure.

Recommendations For IBM Security Guardium version 11.4, as a temporary workaround, consider restricting access to the database to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-07922

CVE-2023-33852

Affected Products

Ibm Security Guardium

References · 11

• https://bdu.fstec.ru/vul/2023-07922 · Security Note
• https://ibm.com/support/pages/node/7028514 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33852 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/257614 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33852 · Vendor Advisory
• https://twitter.com/cracbot/status/1696039996300685454 · Twitter Post
• https://twitter.com/TechFishNews/status/1695958325115134207 · Twitter Post
• https://t.me/cvenotify/57499 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1695959782388093156 · Twitter Post
• https://t.me/cibsecurity/69254 · Telegram Post
• https://twitter.com/CVEnew/status/1695932429377347908 · Twitter Post