{"id":"CVE-2023-25924","state":"PUBLISHED","title":"IBM Security Key Lifecycle Manager improper authorization","description":"IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization.  IBM X-Force ID:  247630.","publishedAt":"2023-03-21T14:53:38.493Z","updatedAt":"2025-02-26T16:48:20.517Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"ibm"},"assigner":"ibm","products":["IBM Security Key Lifecycle Manager"],"affected":[{"vendor":"IBM","product":"Security Key Lifecycle Manager","defaultStatus":"unaffected","versions":[{"version":"3.0, 3.0.1, 4.0, 4.1 , 4.1.1","status":"affected"}]}],"references":["https://www.ibm.com/support/pages/node/6962729","https://exchange.xforce.ibmcloud.com/vulnerabilities/247630"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/25xxx/CVE-2023-25924.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-25924","state":"PUBLISHED","datePublished":"2023-03-21T14:53:38.493Z","dateUpdated":"2025-02-26T16:48:20.517Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2023-02-16T16:39:45.212Z"},"containers":{"cna":{"title":"IBM Security Key Lifecycle Manager improper authorization","descriptions":[{"lang":"en","value":"IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization.  IBM X-Force ID:  247630."}],"affected":[{"vendor":"IBM","product":"Security Key Lifecycle Manager","defaultStatus":"unaffected","versions":[{"version":"3.0, 3.0.1, 4.0, 4.1 , 4.1.1","status":"affected"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/6962729","tags":["vendor-advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/247630","tags":["vdb-entry"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2023-03-22T04:39:15.803Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.ibm.com/support/pages/node/6962729","tags":["vendor-advisory","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/247630","tags":["vdb-entry","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T11:32:12.755Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-26T16:48:08.214652Z","id":"CVE-2023-25924","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-26T16:48:20.517Z"}}]}}}