CVE-2023-25687
Published: 21 March 2023
Summary
CVE-2023-25687 is a medium-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Ibm Security Key Lifecycle Manager. Its CVSS base score is 4.3 (Medium).
Operationally, ranked in the top 43.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-29602
Vulnerability details
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files. IBM X-Force ID: 247602.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Detects error messages that leak sensitive information as evidence of disclosure.
Validation ensures error messages contain only expected, non-sensitive content and blocks leakage via verbose errors.
Procedures mandate excluding sensitive data from logs to prevent unauthorized exposure via audit records.
Cross-organizational coordination enables agreement on what data to include in audit logs, directly reducing insertion of sensitive information.
Identifying logging as a data action allows prevention of sensitive information being inserted into log files.
The control directly mitigates generation of error messages containing sensitive authentication details by requiring obscured feedback instead of verbose responses.
The process of identifying and eradicating spilled information applies directly to sensitive data inserted into log files.
Specific processing rules for sensitive PII categories commonly include restrictions on logging, making insertion of such data into log files less likely.