Medium WID-SEC-2025-0254 6 CVEs

IBM Security Verify Access: Mehrere Schwachstellen

Published Feb 3, 2025 · Updated Feb 3, 2025 · de-DE

Vendor: IBM Product: Security Verify Access Platform: Windows

Summary

Ein anonymer oder lokaler Angreifer kann mehrere Schwachstellen in IBM Security Verify Access ausnutzen, um Informationen preiszugeben, erhöhte Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen und einen Cross-Site-Scripting-Angriff durchzuführen.

Product

IBM Security Verify Access, ehemals IBM Security Access Manager (ISAM), ist eine Zugriffsverwaltungslösung.

Vulnerabilities 6

Medium 6.5

CVE-2024-35138

IBM Security Verify Access cross-site request forgery

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

IBM Security Verify Access Container Security Verify Access Appliance

Feb 4, 2025
Medium 6.1

CVE-2024-40700

IBM Security Verify Access cross-site scripting

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pot…

IBM Security Verify Access Container Security Verify Access Appliance

Feb 4, 2025
Medium 5.9

CVE-2024-43187

IBM Security Verify Access information disclosure

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

IBM Security Verify Access Container Security Verify Access Appliance

Feb 4, 2025
Medium 5.3

CVE-2024-45659

IBM Security Verify Access information disclosure

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

IBM Security Verify Access Container Security Verify Access Appliance

Feb 4, 2025
Medium 5.0

CVE-2024-45657

IBM Security Verify Access incorrect privilege assignment

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment.

IBM Security Verify Access Container Security Verify Access Appliance

Feb 4, 2025
Low 2.7

CVE-2024-45658

IBM Security Verify Access information disclosure

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

IBM Security Verify Access Container Security Verify Access Appliance

Feb 4, 2025

Revision history

2025-02-03 #1
Initiale Fassung

References

IBM Security Bulletin vom 2025-02-03
https://www.ibm.com/support/pages/node/7182386