CVE-2021-39025

Vulnerability

IBM Guardium Data Encryption (GDE) versions 4.0.0.0 and 5.0.0.0 contain an information exposure vulnerability where internal IP address information can be disclosed when the web backend is down. Affected components include Guardium Cloud Key Manager (GCKM) 1.10.1 and lower, CipherTrust Tokenization Server (CT-VL) 2.6.3 and lower, and Guardium Data Encryption Server (DSM) 4.0.0.7 and lower [1].

Exploitation

The vulnerability can be exploited by an unauthenticated attacker with network access to the affected system. The attack complexity is low, and no privileges or user interaction are required [1]. The specific sequence involves inducing a web backend failure, which leads to the exposure of internal IP addresses.

Impact

Successful exploitation results in the disclosure of internal IP addresses, potentially aiding an attacker in mapping the internal network. The confidentiality impact is low, and there is no impact on integrity or availability [1].

Mitigation

IBM has released updated versions to address this vulnerability. Users should apply the latest available version for their specific component. No workarounds or mitigations are listed [1].