Severity
Medium
Analysis Summary
CVE-2023-38267 CVSS:6.2
IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain sensitive configuration information.
CVE-2023-31001 CVSS:5.1
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporarily stores sensitive information in files that could be accessed by a local user.
CVE-2023-31003 CVSS:8.4
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain root access due to improper access controls.
Impact
- Information Disclosure
- Privilege Escalation
Indicators Of Compromise
CVE
- CVE-2023-38267
- CVE-2023-31001
- CVE-2023-31003
Affected Vendors
IBM
Affected Products
- IBM Security Verify Access Appliance 10.0.0.0
- IBM Security Verify Access Docker 10.0.0.0
- IBM Security Verify Access Docker 10.0.6.1
- IBM Security Verify Access Appliance 10.0.6.1
Remediation
Refer to IBM Security Advisory for patch, upgrade or suggested workaround information.