title: IBM Security Guardium Key Lifecycle Manager file upload
description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.  IBM X-Force ID:  247621.
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
defaultStatus: unaffected
product: Security Guardium Key Lifecycle Manager
vendor: IBM
versions:
status: affected, version: 3.0, 3.0.1, 4.0, 4.1, 4.1.1
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL