What is CVE-2023-25924?

CVE-2023-25924 is a medium-severity vulnerability in IBM Security Key Lifecycle Manager, classified under Incorrect Authorization. CVSS score: 5.4/10. Published 2023-03-22.

How severe is CVE-2023-25924?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Auth bypass in IBM Security Key Lifecycle Manager

CVE-2023-25924

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630.

Vulnerability class: Broken Access Control

EPSS: 0.004 (32.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Ibm Security Key Lifecycle Manager — versions 3.0, 3.0.1, 4.0, 4.1 , 4.1.1
Ibm Security_key_lifecycle_manager — versions 3.0, 3.0.1, 4.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

psirt@us.ibm.com (vendor-advisory, Patch, Vendor Advisory)
psirt@us.ibm.com (VDB Entry, vdb-entry, Vendor Advisory)

Frequently asked questions

What is CVE-2023-25924?: CVE-2023-25924 is a medium-severity vulnerability in IBM Security Key Lifecycle Manager, classified under Incorrect Authorization. CVSS score: 5.4/10. Published 2023-03-22.
How severe is CVE-2023-25924?: Medium severity. CVSS v3 base score is 5.4 out of 10.