CVE-2023-33838

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-33838
IBM Security Verify Governance 10.0.2 Identity Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.ibm.com/support/pages/node/7172200 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:security_verify_governance:10.0.2:*:*:*:*:*:*:*
History

04 Mar 2025, 21:58

Type Values Removed Values Added
References () https://www.ibm.com/support/pages/node/7172200 - () https://www.ibm.com/support/pages/node/7172200 - Vendor Advisory
CWE CWE-916
Summary
  • (es) IBM Security Verify Governance 10.0.2 Identity Manager utiliza un hash criptográfico unidireccional contra una entrada que no debe ser reversible, como una contraseña, pero el producto no utiliza una sal como parte de la entrada.
CPE cpe:2.3:a:ibm:security_verify_governance:10.0.2:*:*:*:*:*:*:*
First Time Ibm
Ibm security Verify Governance

29 Jan 2025, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-29 02:15

Updated : 2025-03-04 21:58

NVD link : CVE-2023-33838

Mitre link : CVE-2023-33838

CVE.ORG link : CVE-2023-33838

JSON object : View

Products Affected

ibm

  • security_verify_governance
CWE
CWE-759

Use of a One-Way Hash without a Salt

CWE-916

Use of Password Hash With Insufficient Computational Effort