Skip to main content

Password in Configuration File

CVE-2024-49817

Medium
4.4/10

Summary

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores user credentials in configuration files which can be read by a local privileged user.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • NONE
  • HIGH
  • HIGH
  • NONE

CWE-260 - Password in Configuration File

The software stores a password in a configuration file that might be accessible to actors who do not know the password.

References

Advisory Timeline

  • Published