CVE-2021-38978 : IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information,

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 212783.

Published 2021-11-15 16:15:10

Updated 2022-06-28 14:11:45

Source IBM Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-38978

EPSS FAQ

0.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-38978

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.9	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	IBM Corporation
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2021-38978

https://www.ibm.com/support/pages/node/6516050

Security Bulletin: Missing http strict transport security header in in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38978)
Patch;Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/212783

IBM Tivoli Key Lifecycle Manager information disclosure CVE-2021-38978 Vulnerability Report
VDB Entry;Vendor Advisory

Products affected by CVE-2021-38978

IBM » Security Key Lifecycle Manager
Versions from including (>=) 4.0 and up to, including, (<=) 4.0.0.3
cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Security Key Lifecycle Manager
Versions from including (>=) 3.0 and up to, including, (<=) 3.0.0.4
cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Security Key Lifecycle Manager
Versions from including (>=) 3.0.1 and up to, including, (<=) 3.0.1.5
cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Security Key Lifecycle Manager » Version: 4.1.0
cpe:2.3:a:ibm:security_key_lifecycle_manager:4.1.0:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Security Key Lifecycle Manager » Version: 4.1.0.1
cpe:2.3:a:ibm:security_key_lifecycle_manager:4.1.0.1:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Security Key Lifecycle Manager » Version: 4.1.1
cpe:2.3:a:ibm:security_key_lifecycle_manager:4.1.1:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Security Guardium Key Lifecycle Manager » Version: 4.1.1
cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.1:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Security Guardium Key Lifecycle Manager » Version: 4.1.0
cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.0:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » Security Guardium Key Lifecycle Manager » Version: 4.1.0.1
cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.0.1:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A

Vulnerability Details : CVE-2021-38978

Exploit prediction scoring system (EPSS) score for CVE-2021-38978

CVSS scores for CVE-2021-38978

CWE ids for CVE-2021-38978

References for CVE-2021-38978

Products affected by CVE-2021-38978