{"id":"CVE-2026-84229","kind":"vulnerability","aliases":["CVE-2026-84229"],"related":[],"title":"IBM Guardium Data Protection: CSRF token check skipped on GET requests","description":"IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests.","summary":"IBM Guardium Data Protection 12.2.4 does not properly validate CSRF tokens on GET requests. A remote attacker can use this to bypass security restrictions in the web interface.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-guardium","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"- Confirm the installed product and version in the Guardium admin console; the sources name version 12.2.4 as affected.","fix":null,"status":"open","published_at":"2026-11-08T19:17:41+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","triaged_at":"2026-11-08T19:23:15+00:00","updated_at":"2026-11-08T19:23:15+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T19:23:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Guardium Data Protection: CSRF token check skipped on GET requests","impact":"medium","summary":"IBM Guardium Data Protection 12.2.4 does not properly validate CSRF tokens on GET requests. A remote attacker can use this to bypass security restrictions in the web interface.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-guardium","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker bypasses security restrictions in the Guardium web interface","analyst_note":"Check the IBM security bulletin for CVE-2026-84229 for the fixed version and affected endpoints; the NVD entry gives no fix or configuration detail.","how_to_check":"- Confirm the installed product and version in the Guardium admin console; the sources name version 12.2.4 as affected.\n- unknown for other checks: the sources do not say which configuration or endpoints are exposed.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running IBM Guardium Data Protection 12.2.4, the database activity monitoring and data security appliance. The sources do not say whether exposure depends on configuration or which endpoints are reachable, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4515,"output_tokens":519,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-84229':14A,17A '12.2.4':29B,57C 'allow':59C 'attack':41B,62C 'bypass':46B,64C 'check':7A 'could':58C 'csrf':5A,34B,72C 'cve':12A,15A 'data':3A,27B,55C 'due':67C 'get':10A,37B,75C 'guardium':2A,20B,26B,54C 'host':23B 'ibm':1A,19B,25B,53C 'ibm-guardium':18B 'improp':69C 'interfac':52B 'proper':32B 'protect':4A,28B,56C 'remot':40B,61C 'request':11A,38B,76C 'restrict':48B,66C 'secur':47B,65C 'self':22B 'self-host':21B 'skip':8A 'token':6A,35B,73C 'use':43B 'valid':33B,70C 'vendor':24B 'web':51B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Guardium Data Protection 12.2.4, the database activity monitoring and data security appliance. The sources do not say whether exposure depends on configuration or which endpoints are reachable, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmguardium","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-84229':14A,17A 'check':7A 'csrf':5A 'cve':12A,15A 'data':3A 'get':10A 'guardium':2A 'ibm':1A 'protect':4A 'request':11A 'skip':8A 'token':6A","search_b":"'12.2.4':29B 'attack':41B 'bypass':46B 'csrf':34B 'data':27B 'get':37B 'guardium':20B,26B 'host':23B 'ibm':19B,25B 'ibm-guardium':18B 'interfac':52B 'proper':32B 'protect':28B 'remot':40B 'request':38B 'restrict':48B 'secur':47B 'self':22B 'self-host':21B 'token':35B 'use':43B 'valid':33B 'vendor':24B 'web':51B","search_c":"'12.2.4':57C 'allow':59C 'attack':62C 'bypass':64C 'could':58C 'csrf':72C 'data':55C 'due':67C 'get':75C 'guardium':54C 'ibm':53C 'improp':69C 'protect':56C 'remot':61C 'request':76C 'restrict':66C 'secur':65C 'token':73C 'valid':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84229","severity":null,"published_at":"2026-11-08T19:17:41+00:00","modified_at":"2026-11-08T19:17:41+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","fetched_at":"2026-11-08T19:22:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}