CVE-2023-25926

MEDIUM

IBM Security Guardium Key Lifecycle Manager 3.0-4.1.1 - XML External Entity Injection

Title source: llm

Description

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 247599.

References (2)

Core 2

Core References

VDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/247599

Patch, Vendor Advisory vendor-advisory

https://www.ibm.com/support/pages/node/6964516

Scores

CVSS v3 5.5

EPSS 0.0138

EPSS Percentile 68.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-611

Status published

Products (1)

ibm/security_guardium_key_lifecycle_manager 3.0.0 - 4.1.1.7

Published Feb 29, 2024

Tracked Since Feb 18, 2026