High severity · published Feb 7, 2024
CVE-2023-38369
IBM Security Access Manager Container information disclosure
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SV
Security Verify Access Appliance · IBM
10.0.0.0 through 10.0.6.1 · source: vendor
SV
Security Verify Access Docker · IBM
10.0.0.0 through 10.0.6.1 · source: vendor
SA
Security Access Manager Container · Ibm
10.0.0.0 through 10.0.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-38369
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-38369
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/261196
Patch
https://www.ibm.com/support/pages/node/7106586
seclists.org
http://seclists.org/fulldisclosure/2024/Nov/0
More from Security Verify Access Appliance
10.0
CVE-2024-28787
IBM Security Verify Access information disclosure
9.8
CVE-2023-32330
IBM Security Verify Access man in the middle
9.8
CVE-2023-32328
IBM Security Verify Access information disclosure
9.0
CVE-2023-31004
IBM Security Access Manager Container gain access
8.1
CVE-2024-31871
IBM Security Verify Access Appliance improper certificate validation