Skip to content
OpenAdvisories
Medium WID-SEC-2024-1462 7 CVEs

IBM Security Verify Access: Mehrere Schwachstellen

Published Jun 25, 2024 · Updated Jun 25, 2024 · de-DE

Vendor: IBM Product: Security Verify Access

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM Security Verify Access ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder seine Berechtigungen zu erweitern.

Product

IBM Security Verify Access, ehemals IBM Security Access Manager (ISAM), ist eine Zugriffsverwaltungslösung.

Vulnerabilities 7

  • High 7.8
    CVE-2023-30997

    IBM Security Access Manager Docker privilege escalation

    IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254638.

    IBM Security Access Manager Docker
  • High 7.8
    CVE-2023-30998

    IBM Security Access Manager Docker privilege escalation

    IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254649.

    IBM Security Access Manager Docker
  • High 7.5
    CVE-2023-38370

    IBM Security Access Manager Docker information disclosure

    IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages. IBM X-Force ID: 261197.

    IBM Security Access Manager Docker
  • Medium 6.2
    CVE-2024-35137

    IBM Security Access Manager Docker information disclosure

    IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 292413.

    IBM Security Verify Access Docker
  • Medium 6.2
    CVE-2024-35139

    IBM Security Access Manager Docker information disclosure

    IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from the container due to incorrect default permissions. IBM X-Force ID: 292415.

    IBM Security Verify Access Docker
  • Medium 5.9
    CVE-2023-38371

    IBM Security Access Manager Docker information disclosure

    IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 261198.

    IBM Security Access Manager Docker
  • Medium 5.5
    CVE-2023-38368

    IBM Security Access Manager Docker information disclosure

    IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls. IBM X-Force ID: 261195.

    IBM Security Access Manager Docker

Revision history

  1. #1

    Initiale Fassung

References