IBM Security Guardium Data Encryption information disclosure

Vulnerability

IBM Guardium Cloud Key Manager (GCKM) version 1.10.3 and lower, part of IBM Security Guardium Data Encryption (GDE), exposes detailed technical error messages in the browser. This information disclosure occurs when the application returns verbose error responses, potentially revealing internal system details [1].

Exploitation

An unauthenticated remote attacker can trigger error conditions that cause the application to return verbose error messages. No authentication or user interaction is required; the attacker simply sends crafted requests to the vulnerable endpoint and observes the response [1].

Impact

Successful exploitation allows the attacker to obtain sensitive technical information about the system. This information could be used to further attack the system. The CVSS v3.0 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating low confidentiality impact with no integrity or availability impact [1].

Mitigation

IBM has released a fix. Affected users should update to the latest version of IBM Guardium Data Encryption. Apply the patch as referenced in the IBM support page [1]. No workaround is mentioned in the reference.