IBM Security Guardium Data Encryption information disclosure

Vulnerability

IBM Security Guardium Data Encryption, specifically IBM Guardium Cloud Key Manager (GCKM) version 1.10.3 and lower, uses an inadequate account lockout setting. This flaw resides in the authentication mechanism, allowing unlimited login attempts without account lockout after successive failures. [1]

Exploitation

A remote attacker with network access to the GCKM login interface can repeatedly attempt authentication against user accounts. No prior authentication or special privileges are required. The attacker can systematically guess credentials, leveraging the absence of a lockout policy to perform an efficient brute-force attack. [1]

Impact

Successful brute-force attacks could lead to unauthorized access to the affected system, potentially resulting in disclosure of sensitive information (confidentiality impact) with low severity, according to the CVSS vector. The attacker gains user-level access, which could be used as a stepping stone for further attacks. [1]

Mitigation

IBM has released a fix in Guardium Data Encryption version 1.10.3.1 and later. Users should upgrade to the latest version available from IBM support. No workaround is documented; applying the patch is the recommended mitigation. [1]