Login Request a demo
Medium severity · published Feb 21, 2025
CVE-2024-45673
IBM Security Verify Bridge information disclosure
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores user credentials in configuration files which can be read by a local user.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SV
Security Verify Bridge Directory Sync · IBM
1.0.1 through 1.0.12 · source: vendor, NVD
SV
Security Verify Gateway For Radius · Ibm
1.0.1 through 1.0.11 · source: NVD
SV
Security Verify Gateway For Windows Login · Ibm
1.0.1 through 1.0.10 · source: NVD
Affected product
SV
Security Verify Bridge Directory Sync
IBM
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45673
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45673
Vendor Advisory
https://www.ibm.com/support/pages/node/7183801
More from Security Verify Bridge Directory Sync
7.5
CVE-2021-38864
IBM Security Verify Bridge 1.0.5.0 could allow a user to obtain sensitive information due to improper certificate validation
7.5
CVE-2021-20442
IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to…
6.0
CVE-2024-45672
IBM Security Verify Bridge data manipulation
5.9
CVE-2021-20441
IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
5.5
CVE-2021-38863
IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a locally authenticated user