CVE-2023-33852: 
IBM Guardium Appliance vulnerability analysis and mitigation

IBM Security Guardium 11.4 was identified with a SQL injection vulnerability (CVE-2023-33852), discovered and disclosed in August 2023. The vulnerability affects IBM Security Guardium versions 11.4 and 11.5. A remote attacker could potentially exploit this vulnerability by sending specially crafted SQL statements to view, add, modify, or delete information in the back-end database (IBM Support).

The vulnerability is classified as a SQL injection (CWE-89) with a CVSS v3.1 Base Score of 7.6 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). The attack requires network access and low privileges, with no user interaction needed. The scope is unchanged, but it can result in high confidentiality impact and low integrity and availability impacts (NVD).

If successfully exploited, this vulnerability allows attackers to view, add, modify, or delete information in the back-end database. The high CVSS score indicates significant potential impact, particularly on data confidentiality, with lower but still notable impacts on data integrity and system availability (IBM Support).

IBM has released security fixes for affected versions. For Guardium 11.4, users should apply SqlGuard_11.0p475_Bundle_Jul-20-2023, and for version 11.5, SqlGuard_11.0p530_Bundle_Aug-29-2023 should be applied. No alternative workarounds or mitigations are available, making it crucial for users to apply the provided patches (IBM Support).