IBM OpenPages with Watson 8.3/9.0 password recoverable

Summaryinfo

A vulnerability identified as problematic has been detected in IBM OpenPages with Watson 8.3/9.0. This issue affects some unknown processing of the component OpenPages. The manipulation leads to password recoverable. This vulnerability is traded as CVE-2023-38738. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM OpenPages with Watson 8.3/9.0 and classified as problematic. This issue affects some unknown functionality of the component OpenPages. The manipulation with an unknown input leads to a password recoverable vulnerability. Using CWE to declare the problem leads to CWE-257. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is using Native authentication an attacker with access to the OpenPages database could through a series of specially crafted steps could exploit this weakness and gain unauthorized access to other OpenPages accounts. IBM X-Force ID: 262594.

The weakness was shared 01/19/2024. It is possible to read the advisory at ibm.com. The identification of this vulnerability is CVE-2023-38738 since 07/25/2023. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (262594). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• IBM

Name

• OpenPages with Watson

Version

• 8.3
• 9.0

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion