IBM Security Guardium critical vulnerability allows execution arbitrary commands

A critical Command Injection vulnerability is reported in IBM Security Guardium, allowing malicious actors to execute arbitrary commands remotely on the impacted system.

IBM Security Guardium serves as a data protection platform utilized by security teams to automatically analyze sensitive data environments, encompassing cloud setups, big data platforms, databases, data warehouses, file systems, and more.

This vulnerability, is tracked as CVE-2023-35893 (CVSS3 score of 9.9) - a Command injection in CLI" vulnerability, which allows an unauthenticated attacker to launch unrestricted commands on the compromised system by transmitting specifically crafted inputs The vulnerability stems from the improper handling of special elements used in operating system commands, as categorized.

To address this vulnerability, IBM has promptly issued security patches, and has outlined a set of instructions for each version of IBM Security Guardium.

Affected Products and Fixed in version