Login Request a demo
Critical severity · published Aug 11, 2021
CVE-2021-20418
IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts
9.8
CVSS
1%
EPSS
No
On KEV
Description
IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196279.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
Security Guardium · Ibm
11.2 · source: NVD
Affected product
SG
Security Guardium
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20418
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20418
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/196279
Vendor Advisory
https://www.ibm.com/support/pages/node/6479899
More from Security Guardium
9.9
CVE-2017-1253
IBM Security Guardium 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system
9.8
CVE-2020-4690
IBM Security Guardium 11.3 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to…
9.8
CVE-2021-20426
IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to…
9.8
CVE-2020-4193
IBM Security Guardium 11.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials
9.8
CVE-2020-4177
IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to…