CVE-2021-20418: 
IBM Guardium Appliance vulnerability analysis and mitigation

IBM Security Guardium 11.2 contains a weak authentication vulnerability (CVE-2021-20418) where the system does not require strong passwords by default. This vulnerability was disclosed on August 10, 2021, affecting multiple versions of IBM Security Guardium including versions 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 (IBM Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.7 with the following vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. This indicates that the vulnerability is network accessible, requires low attack complexity, needs no privileges, requires user interaction, has a changed scope, and can impact confidentiality with low severity while having no impact on integrity or availability (IBM Advisory).

The weak password policy makes it easier for attackers to compromise user accounts through various password-based attacks. This could potentially lead to unauthorized access to sensitive information and system resources (IBM Advisory).

IBM has released security fixes for all affected versions. Patches are available through IBM Fix Central for versions 10.5 (SqlGuard_10.0p545_Bundle), 10.6 (SqlGuard_10.0p675_Bundle), 11.0 (SqlGuard_11.0p40_Bundle), 11.1 (SqlGuard_11.0p150_Bundle), 11.2 (SqlGuard_11.0p250_Bundle), and 11.3 (SqlGuard_11.0p330_Bundle). No workarounds are available for this vulnerability (IBM Advisory).