CVE-2023-26270
Last modified
CVE-2023-26270 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to execute arbitrary code on the system, caused by an angular template injection flaw. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. EPSS estimates a 0.70% chance of exploitation in the next 30 days.
Description
IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to execute arbitrary code on the system, caused by an angular template injection flaw. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 248119.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Guardium Cloud Key Manager | <= 1.10.3 |
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/248119VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6995161Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/248119VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6995161Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-26270?
How severe is CVE-2023-26270?
How do I fix CVE-2023-26270?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-26265The Borg theme before 1.1.19 for Backdrop CMS does not suffi…5.3
- CVE-2023-26266In AFL++ 4.05c, the CmpLog component uses the current workin…7.3
- CVE-2023-26267php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading…6.5
- CVE-2023-26268Design documents with matching document IDs, from databases …5.3
- CVE-2023-26269Apache James server version 3.7.3 and earlier provides a JMX…7.8
- CVE-2023-2627The KiviCare WordPress plugin before 3.2.1 does not have pro…4.3
- CVE-2023-26271IBM Security Guardium Data Encryption (IBM Guardium Cloud Ke…7.5
- CVE-2023-26272IBM Security Guardium Data Encryption (IBM Guardium Cloud Ke…5.3
- CVE-2023-26273IBM QRadar SIEM 7.5.0 could allow an authenticated user to p…4.3
- CVE-2023-26274 IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting…5.4
- CVE-2023-26276IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographi…7.5
- CVE-2023-26277IBM QRadar WinCollect Agent 10.0 though 10.1.3 could allow a…7.8
Are you affected by CVE-2023-26270?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST