← Back

CVE-2024-49820

nvd nist
Published: Dec 17, 2024Modified: Jun 17, 2026

JSON object

Loading...
3.7
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.2 / Impact: 1.4
Source: psirt@us.ibm.com (Secondary)

Description

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

Affected (4)

Ibm
1 product
Security Guardium Key Lifecycle Manager
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Security Guardium Key Lifecycle Manager
Version 4.1.0
Security Guardium Key Lifecycle Manager
Version 4.1.1
Security Guardium Key Lifecycle Manager
Version 4.2.0
Security Guardium Key Lifecycle Manager
Version 4.2.1

Related CWEs

CWE-319
Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (1)

Source: psirt@us.ibm.com
Vendor Advisory

Timeline

No history available yet.