CVE-2021-38973

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVSS v3 2.7 LOW
CVSS v2.0 4.0 MEDIUM

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/212778	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6515528	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager::::::::
	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.1:::::::*
	cpe:2.3:a:ibm:security_key_lifecycle_manager::::::::
	cpe:2.3:a:ibm:security_key_lifecycle_manager::::::::
	cpe:2.3:a:ibm:security_key_lifecycle_manager::::::::

History

16 Nov 2021, 16:20

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 4.0 v3 : 2.7
References	~~(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/212778 -~~	(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/212778 - VDB Entry, Vendor Advisory
References	~~(CONFIRM) https://www.ibm.com/support/pages/node/6515528 -~~	(CONFIRM) https://www.ibm.com/support/pages/node/6515528 - Patch, Vendor Advisory
CPE		cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:::::::: cpe:2.3:a:ibm:security_key_lifecycle_manager:::::::: cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.1:::::::*
CWE		CWE-20

12 Nov 2021, 16:28

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-11-12 16:15

Updated : 2023-12-10 14:09

NVD link : CVE-2021-38973

Mitre link : CVE-2021-38973

CVE.ORG link : CVE-2021-38973

JSON object : View

Products Affected

ibm

security_guardium_key_lifecycle_manager
security_key_lifecycle_manager

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2021-38973", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 2.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "published": "2021-11-12T16:15:07.977", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212778", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/6515528", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly."}, {"lang": "es", "value": "IBM Tivoli Key Lifecycle Manager versiones 3.0, 3.0.1, 4.0 y 4.1, recibe entradas o datos, pero no comprueba o comprueba incorrectamente que la entrada presenta las propiedades necesarias para procesar los datos de forma segura y correcta"}], "lastModified": "2021-11-16T16:20:53.667", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F01AF46-F0FC-4FDE-9C02-D0024A6063CA", "versionEndIncluding": "4.1.0.1", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7C5C5BE-7E5C-455C-80F4-5C5783086D2B"}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8731B4A9-B6D3-434D-AA46-049D213C7BC1", "versionEndIncluding": "3.0.0.4", "versionStartIncluding": "3.0"}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7B38B76-9EC7-423B-9DD4-E732F69198B2", "versionEndIncluding": "3.0.1.5", "versionStartIncluding": "3.0.1"}, {"criteria": "cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E05A09D-6289-4E71-A096-1FDE5D85F52F", "versionEndIncluding": "4.0.0.3", "versionStartIncluding": "4.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}