Inclusion of Sensitive Information in Log Files in IBM DB2 LUW - CVE-2024-25030

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU88129

Inclusion of Sensitive Information in Log Files in IBM DB2 LUW - CVE-2024-25030

Published: April 4, 2024


Vulnerability identifier: #VU88129
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-25030
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.


Affected software

IBM DB2 LUW
IBM DB2
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Intelligent Operations Center
WebSphere Remote Server
IBM Security Verify Governance
IBM Cloud Application Performance Management (APM)
IBM OpenPages with Watson
Datacap
dashDB Local
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Db2 Big SQL
Storage Protect Server

How to mitigate CVE-2024-25030

Install updates from vendor's website.

dashDB Local - update to 11.5.9.0
DB2 on Cloud Pak for Data - update to 4.8.5
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
Db2 Big SQL - update to 7.6.4
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Protect Server - update to 8.1.23
IBM DB2 - update to 11.1.4.7

External References

Related Security Bulletins