Rewterz Threat Advisory – Multiple IBM Security Access Manager Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2023-38267 CVSS:6.2

IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain sensitive configuration information.

CVE-2023-31001 CVSS:5.1

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporarily stores sensitive information in files that could be accessed by a local user.

CVE-2023-31003 CVSS:8.4

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain root access due to improper access controls.

Impact

• Information Disclosure
• Privilege Escalation

Indicators Of Compromise

CVE

• CVE-2023-38267
• CVE-2023-31001
• CVE-2023-31003

Affected Vendors

IBM

Affected Products

• IBM Security Verify Access Appliance 10.0.0.0
• IBM Security Verify Access Docker 10.0.0.0
• IBM Security Verify Access Docker 10.0.6.1
• IBM Security Verify Access Appliance 10.0.6.1

Remediation

Refer to IBM Security Advisory for patch, upgrade or suggested workaround information.

IBM Security Advisory