Medium · 6.5 CVE-2023-35016 EUVD-2023-39053GHSA-wx4c-p4xc-46fq

IBM Security Verify Governance path traversal

Published Jul 31, 2023 · Updated Oct 11, 2024 · Assigned by ibm

Vendor: IBM Product: Security Verify Governance Identity Manager

Description

IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 257772.

Affected products

Vendor	Product	Affected	Fixed
IBM	Security Verify Governance, Identity Manager	10.0	—

Advisories 1

WID-SEC-2023-1914 IBM Security Identity Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 30, 2023

References

https://www.ibm.com/support/pages/node/7014397 vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/25772 vdb-entry