IBM Security Verify Access Appliance up to 10.0.6.1 password recoverable

Summaryinfo

A vulnerability was found in IBM Security Verify Access Appliance and Security Verify Access Docker up to 10.0.6.1 and classified as problematic. This vulnerability affects unknown code. Such manipulation leads to password recoverable. This vulnerability is uniquely identified as CVE-2023-31001. Local access is required to approach this attack. Moreover, an exploit is present. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM Security Verify Access Appliance and Security Verify Access Docker up to 10.0.6.1 (Virtualization Software). It has been rated as problematic. Affected by this issue is an unknown code. The manipulation with an unknown input leads to a password recoverable vulnerability. Using CWE to declare the problem leads to CWE-257. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. Impacted is confidentiality. CVE summarizes:

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254653.

The weakness was disclosed 01/11/2024. The advisory is shared for download at ibm.com. This vulnerability is handled as CVE-2023-31001 since 04/21/2023. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1552.

The exploit is available at packetstormsecurity.com. It is declared as proof-of-concept.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (254653). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Virtualization Software

Vendor

• IBM

Name

• Security Verify Access Appliance
• Security Verify Access Docker

Version

• 10.0.6.0
• 10.0.6.1

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion