CVE-2023-38369

IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/261196	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/7106586	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:security_access_manager_container:*:*:*:*:*:*:*:*

History

10 Feb 2024, 04:01

Type	Values Removed	Values Added
First Time		Ibm Ibm security Access Manager Container
CPE		cpe:2.3:a:ibm:security_access_manager_container::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~6.2~~	v2 : unknown v3 : 7.5
Summary		(es) IBM Security Access Manager Container 10.0.0.0 a 10.0.6.1 no requiere que las imágenes de Docker tengan contraseñas seguras de forma predeterminada, lo que facilita que los atacantes comprometan las cuentas de usuario. ID de IBM X-Force: 261196.
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/261196 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/261196 - VDB Entry, Vendor Advisory
References	~~() https://www.ibm.com/support/pages/node/7106586 -~~	() https://www.ibm.com/support/pages/node/7106586 - Patch, Vendor Advisory

07 Feb 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-07 17:15

Updated : 2024-02-10 04:01

NVD link : CVE-2023-38369

Mitre link : CVE-2023-38369

CVE.ORG link : CVE-2023-38369

JSON object : View

Products Affected

ibm

security_access_manager_container

CWE

CWE-521

Weak Password Requirements

{"id": "CVE-2023-38369", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "published": "2024-02-07T17:15:09.053", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/261196", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/7106586", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-521"}]}], "descriptions": [{"lang": "en", "value": "IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196."}, {"lang": "es", "value": "IBM Security Access Manager Container 10.0.0.0 a 10.0.6.1 no requiere que las im\u00e1genes de Docker tengan contrase\u00f1as seguras de forma predeterminada, lo que facilita que los atacantes comprometan las cuentas de usuario. ID de IBM X-Force: 261196."}], "lastModified": "2024-02-10T04:01:12.283", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_access_manager_container:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "408F2EBF-CCE3-47A8-B835-1C71CA62777E", "versionEndIncluding": "10.0.6.1", "versionStartIncluding": "10.0.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}