Rewterz Threat Advisory – Multiple IBM Security Guardium Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2023-30437 CVSS:5.3

IBM Security Guardium 11.3, 11.4, and 11.5 could allow an unauthorized user to enumerate usernames by sending a specially crafted HTTP request.

CVE-2023-30436 CVSS:5.5

IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. 

CVE-2023-30435 CVSS:8.9

IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Impact

• Information Disclosure
• Cross-Site Scripting

Indicators Of Compromise

CVE

• CVE-2023-30437
• CVE-2023-30436
• CVE-2023-30435

Affected Vendors

IBM

Affected Products

• IBM Security Guardium 11.3
• IBM Security Guardium 11.4
• IBM Security Guardium 11.5

Remediation

Refer to IBM Security Bulletin for patch, upgrade or suggested workaround information.

IBM Security Bulletin