description: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
problem types: Gain Access
affected:
{
product: Security Key Lifecycle Manager
vendor: IBM
versions:
status: affected, version: 3.0
status: affected, version: 3.0.1
status: affected, version: 4.0
status: affected, version: 3.0.0.4
status: affected, version: 3.0.1.5
status: affected, version: 4.0.0.3
status: affected, version: 4.1.0.1
status: affected, version: 4.1.1
status: affected, version: 4.1.0
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.4
baseSeverity: LOW
confidentialityImpact: NONE
exploitCodeMaturity: UNPROVEN
integrityImpact: LOW
privilegesRequired: HIGH
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 2.1
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.0/UI:R/AV:N/A:N/C:N/S:U/I:L/AC:L/PR:H/RL:O/RC:C/E:U
version: 3.0
]