{"id":"CVE-2023-25924","aliases":["EUVD-2023-29812","GHSA-7733-wh9m-x4gj"],"status":"published","title":"IBM Security Key Lifecycle Manager improper authorization","description":"IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization.  IBM X-Force ID:  247630.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00398,"percentile":0.34348,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2023-03-21T14:53:38Z","modified":"2026-06-17T05:42:16Z","products":[{"vendor":"ibm","product":"security key lifecycle manager"},{"vendor":"ibm","product":"security_key_lifecycle_manager"}],"references":[{"url":"https://www.ibm.com/support/pages/node/6962729","tags":["vendor-advisory","x_transferred","Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/247630","tags":["vdb-entry","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25924"},{"url":"https://github.com/advisories/GHSA-7733-wh9m-x4gj"}],"sources":{"cve":[{"id":"CVE-2023-25924","title":"IBM Security Key Lifecycle Manager improper authorization","description":"IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization.  IBM X-Force ID:  247630.","status":"published","published":"2023-03-21T14:53:38.493Z","modified":"2025-02-26T16:48:20.517Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-29812","description":"IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization.  IBM X-Force ID:  247630.","status":"published","published":"2023-03-21T14:53:38Z","modified":"2025-02-26T16:48:20Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:23.257772Z"}],"ghsa":[{"id":"GHSA-7733-wh9m-x4gj","title":"IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an...","description":"IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630.","status":"published","published":"2023-03-22T06:30:21Z","modified":"2023-04-01T05:06:11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:54:25.73686Z"}],"nvd":[{"id":"CVE-2023-25924","description":"IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization.  IBM X-Force ID:  247630.","status":"published","published":"2023-03-22T06:15:10.74Z","modified":"2026-06-17T05:42:16.037Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:50.908252Z"}]}}