CVE-2023-30435: 
IBM Guardium Appliance vulnerability analysis and mitigation

IBM Security Guardium versions 11.3, 11.4, and 11.5 are affected by a stored cross-site scripting vulnerability (CVE-2023-30435). The vulnerability was discovered and reported to IBM by Dawid Bakaj & Michał Brzezicki, and was publicly disclosed on August 23, 2023 (IBM Advisory).

The vulnerability allows users to embed arbitrary JavaScript code in the Web UI, which can alter the intended functionality of the application. The severity of this vulnerability is rated as HIGH with a CVSS v3.1 base score of 8.9 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L). The vulnerability requires low privileged access and user interaction to be exploited (IBM Advisory, NVD).

If successfully exploited, this vulnerability could potentially lead to credentials disclosure within a trusted session. The high severity rating indicates significant potential impact on the confidentiality and integrity of the system, with some impact on availability (IBM Advisory).

IBM has released security fixes for all affected versions. Customers are encouraged to update their systems promptly with the following patches: For version 11.3: SqlGuard11.0p387Security-Fix, for version 11.4: SqlGuard11.0p475BundleJul-20-2023, and for version 11.5: SqlGuard11.0p530BundleAug-29-2023. No workarounds or alternative mitigations are available (IBM Advisory).