cnvd - cnvd-2025-01796

CNVD-2025-01796

Vulnerability from cnvd - Published: 2025-01-20

Title

IBM Security Guardium Key Lifecycle Manager信息泄露漏洞（CNVD-2025-01796）

Description

IBM Security Guardium Key Lifecycle Manager是国际商业机器（IBM）公司的一种加密密钥管理工具。可集中、简化和自动化密钥管理流程。 IBM Security Guardium Key Lifecycle Manager存在信息泄露漏洞，攻击者可利用该漏洞在浏览器返回详细的技术错误消息时获取敏感信息。

Severity

中

Patch Name

IBM Security Guardium Key Lifecycle Manager信息泄露漏洞（CNVD-2025-01796）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/7175067

Reference

https://www.ibm.com/support/pages/node/7175067

Impacted products

Name
['IBM IBM Security Guardium Key Lifecycle Manager 4.1.1', 'IBM IBM Security Guardium Key Lifecycle Manager 4.1', 'IBM IBM Security Guardium Key Lifecycle Manager 4.2.0', 'IBM IBM Security Guardium Key Lifecycle Manager 4.2.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-49818",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-49818"
    }
  },
  "description": "IBM Security Guardium Key Lifecycle Manager\u662f\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u79cd\u52a0\u5bc6\u5bc6\u94a5\u7ba1\u7406\u5de5\u5177\u3002\u53ef\u96c6\u4e2d\u3001\u7b80\u5316\u548c\u81ea\u52a8\u5316\u5bc6\u94a5\u7ba1\u7406\u6d41\u7a0b\u3002\n\nIBM Security Guardium Key Lifecycle Manager\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u6d4f\u89c8\u5668\u8fd4\u56de\u8be6\u7ec6\u7684\u6280\u672f\u9519\u8bef\u6d88\u606f\u65f6\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/7175067",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-01796",
  "openTime": "2025-01-20",
  "patchDescription": "IBM Security Guardium Key Lifecycle Manager\u662f\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u79cd\u52a0\u5bc6\u5bc6\u94a5\u7ba1\u7406\u5de5\u5177\u3002\u53ef\u96c6\u4e2d\u3001\u7b80\u5316\u548c\u81ea\u52a8\u5316\u5bc6\u94a5\u7ba1\u7406\u6d41\u7a0b\u3002\r\n\r\nIBM Security Guardium Key Lifecycle Manager\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u6d4f\u89c8\u5668\u8fd4\u56de\u8be6\u7ec6\u7684\u6280\u672f\u9519\u8bef\u6d88\u606f\u65f6\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Security Guardium Key Lifecycle Manager\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2025-01796\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM IBM Security Guardium Key Lifecycle Manager 4.1.1",
      "IBM IBM Security Guardium Key Lifecycle Manager 4.1",
      "IBM IBM Security Guardium Key Lifecycle Manager 4.2.0",
      "IBM IBM Security Guardium Key Lifecycle Manager 4.2.1"
    ]
  },
  "referenceLink": "https://www.ibm.com/support/pages/node/7175067",
  "serverity": "\u4e2d",
  "submitTime": "2024-12-20",
  "title": "IBM Security Guardium Key Lifecycle Manager\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2025-01796\uff09"
}

CVE-2024-49818 (GCVE-0-2024-49818)

Vulnerability from cvelistv5 – Published: 2024-12-17 17:35 – Updated: 2024-12-17 20:37

Summary

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

ibm

References

URL

Tags

https://www.ibm.com/support/pages/node/7175067

vendor-advisory

Impacted products

	Vendor	Product	Version
	IBM	Security Guardium Key Lifecycle Manager	Affected: 4.1, 4.1.1, 4.2.0, 4.2.1 cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.0:::::::* cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.1:::::::* cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.2.0:::::::* cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.2.1:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-17T20:35:14.269037Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-17T20:37:49.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.2.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Security Guardium Key Lifecycle Manager",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "4.1, 4.1.1, 4.2.0, 4.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecould allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.\u003c/span\u003e\n\n\u003c/span\u003e\n\n\n\n\u003c/span\u003e"
            }
          ],
          "value": "IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 \n\ncould allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209 Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-17T17:35:47.807Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/7175067"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Security Guardium Key Lifecycle Manager information disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-49818",
    "datePublished": "2024-12-17T17:35:47.807Z",
    "dateReserved": "2024-10-20T13:40:29.645Z",
    "dateUpdated": "2024-12-17T20:37:49.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2025-01796

CVE-2024-49818 (GCVE-0-2024-49818)

Tags

Sightings

Nomenclature