{"api_version":"1","generated_at":"2026-06-09T22:43:30+00:00","cve":"CVE-2021-38985","urls":{"html":"https://cve.report/CVE-2021-38985","api":"https://cve.report/api/cve/CVE-2021-38985.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-38985","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-38985"},"summary":{"title":"CVE-2021-38985","description":"IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2021-11-12 16:15:00","updated_at":"2021-11-16 16:18:00"},"problem_types":["CWE-20"],"metrics":[],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/212799","name":"ibm-tivoli-cve202138985-input-validation (212799)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"503"},{"url":"https://www.ibm.com/support/pages/node/6515526","name":"https://www.ibm.com/support/pages/node/6515526","refsource":"CONFIRM","tags":[],"title":"Security Bulletin:  Hazardous input validation in IBM Security Guardium Key Lifecycle Manager  (CVE-2021-38985)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38985","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38985","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"38985","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_guardium_key_lifecycle_manager","cpe6":"4.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"38985","vulnerable":"1","versionEndIncluding":"4.1.0.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_guardium_key_lifecycle_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"38985","vulnerable":"1","versionEndIncluding":"3.0.0.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_key_lifecycle_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"38985","vulnerable":"1","versionEndIncluding":"3.0.1.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_key_lifecycle_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"38985","vulnerable":"1","versionEndIncluding":"4.0.0.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_key_lifecycle_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"affects":{"vendor":{"vendor_data":[{"vendor_name":"IBM","product":{"product_data":[{"version":{"version_data":[{"version_value":"3.0"},{"version_value":"3.0.1"},{"version_value":"4.0"},{"version_value":"3.0.0.4"},{"version_value":"3.0.1.5"},{"version_value":"4.0.0.3"},{"version_value":"4.1.0.1"},{"version_value":"4.1.1"},{"version_value":"4.1.0"}]},"product_name":"Security Key Lifecycle Manager"}]}}]}},"data_version":"4.0","impact":{"cvssv3":{"BM":{"C":"N","S":"U","A":"N","SCORE":"4.300","UI":"N","AV":"N","PR":"L","I":"L","AC":"L"},"TM":{"E":"U","RL":"O","RC":"C"}}},"problemtype":{"problemtype_data":[{"description":[{"value":"Gain Access","lang":"eng"}]}]},"data_type":"CVE","data_format":"MITRE","description":{"description_data":[{"lang":"eng","value":"IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly."}]},"references":{"reference_data":[{"refsource":"CONFIRM","url":"https://www.ibm.com/support/pages/node/6515526","name":"https://www.ibm.com/support/pages/node/6515526","title":"IBM Security Bulletin 6515526 (Security Key Lifecycle Manager)"},{"refsource":"XF","name":"ibm-tivoli-cve202138985-input-validation (212799)","title":"X-Force Vulnerability Report","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/212799"}]},"CVE_data_meta":{"ID":"CVE-2021-38985","ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2021-11-11T00:00:00","STATE":"PUBLIC"}},"nvd":{"publishedDate":"2021-11-12 16:15:00","lastModifiedDate":"2021-11-16 16:18:00","problem_types":["CWE-20"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.1:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndIncluding":"3.0.0.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.1","versionEndIncluding":"3.0.1.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:security_key_lifecycle_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndIncluding":"4.0.0.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndIncluding":"4.1.0.1","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"38985","Ordinal":"214663","Title":"CVE-2021-38985","CVE":"CVE-2021-38985","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"38985","Ordinal":"1","NoteData":"IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"38985","Ordinal":"2","NoteData":"2021-11-12","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"38985","Ordinal":"3","NoteData":"2021-11-12","Type":"Other","Title":"Modified"}]}}}