{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "IBM Security Guardium stored cross-site scripting",
    "tracking": {
      "current_release_date": "2025-06-16T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.28"
        },
        "date": "2025-06-20T17:36:13.144Z"
      },
      "id": "VA-25-136-01",
      "initial_release_date": "2025-05-16T20:14:51Z",
      "status": "final",
      "version": "1.1.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2025-05-16T20:14:51Z"
        },
        {
          "number": "1.1.0",
          "summary": "Add acknowledgment",
          "date": "2025-06-16T00:00:00Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "IBM Security Guardium 11.5 before patch 11.0p565 is vulnerable to stored cross-site scripting (XSS). An attacker with administrative privileges could store arbitrary content or script in the administrative web interface that would be rendered or executed by users visiting modified parts of the web interface. The attacker may be able or obtain session tokens which could be used to log in as a different user.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "Apply Guardium Data Protection patch 11.0p565 for Guardium version 11.5.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "United States",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-136-01.json",
        "summary": "Vulnerability Advisory VA-25-136-01 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "IBM",
        "branches": [
          {
            "category": "product_name",
            "name": "Security Guardium",
            "branches": [
              {
                "category": "product_version",
                "name": "11.5",
                "product": {
                  "name": "IBM Security Guardium 11.5",
                  "product_id": "11.5"
                }
              },
              {
                "category": "patch_level",
                "name": "<11.0p565",
                "product": {
                  "name": "IBM Security Guardium 11.5 <11.0p565",
                  "product_id": "<11.0p565"
                }
              },
              {
                "name": "11.0p565",
                "category": "patch_level",
                "product": {
                  "name": "IBM Security Guardium 11.5 11.0p565",
                  "product_id": "11.0p565"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-3440",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
      },
      "notes": [
        {
          "category": "summary",
          "text": "IBM Security Guardium 11.5 before patch 11.0p565 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. \n\nTracked as IBM issue key GRD-97817 and PSIRT: PVR0631190.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:P/2025-05-18T16:39:08Z/"
        }
      ],
      "title": "IBM Security Guardium stored cross-site scripting",
      "product_status": {
        "known_affected": [
          "<11.0p565"
        ],
        "fixed": [
          "11.0p565"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.",
          "url": "https://www.ibm.com/support/pages/node/7233600"
        },
        {
          "category": "external",
          "summary": "Release of Guardium Data Protection patch 11.0p565",
          "url": "https://www.ibm.com/support/pages/node/7230003"
        },
        {
          "category": "external",
          "summary": "IBM Security, IBM Security Guardium (11.5, Linux)",
          "url": "https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.5&platform=Linux&function=fixId&fixids=SqlGuard_11.0p565_Bundle"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "<11.0p565"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Apply Guardium Data Protection patch 11.0p565 for Guardium version 11.5.",
          "url": "https://www.ibm.com/support/pages/node/7230003",
          "product_ids": [
            "<11.0p565"
          ],
          "date": "2025-05-14T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Aaron Ramirez"
          ],
          "organization": "United States Department of Justice"
        }
      ],
      "release_date": "2025-05-15T00:00:00Z",
      "ids": [
        {
          "text": "GRD-97817",
          "system_name": "IBM"
        },
        {
          "text": "PVR0631190",
          "system_name": "IBM PSIRT"
        }
      ]
    }
  ]
}