CVE-2018-1501: 
IBM Guardium Appliance vulnerability analysis and mitigation

IBM Security Guardium versions 10.5, 10.6, and 11.0 contain a vulnerability that could allow an unauthorized user to obtain sensitive information due to missing security controls (CVE-2018-1501). The vulnerability was disclosed on August 26, 2020, and affects IBM Security Guardium EcoSystem (IBM Security Bulletin).

The vulnerability has been assigned a CVSS 3.1 Base Score of 7.5 (HIGH) by NVD with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while IBM Corporation assessed it with a CVSS 3.0 Base Score of 5.3 (MEDIUM) with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) (NVD).

The vulnerability could allow unauthorized users to obtain sensitive information from the affected IBM Security Guardium systems due to missing security controls (IBM Security Bulletin).

The vulnerability can be exploited remotely without requiring authentication or user interaction, as indicated by the CVSS vector strings (NVD).

IBM has released a fix for this vulnerability in IBM Security Guardium version 11.2. Users can obtain the patch through IBM Fix Central. No workarounds or alternative mitigations are available (IBM Security Bulletin).