PT-2023-29448 · Ibm · Ibm I Access Client Solutions

Maksymilian Kubiak + 1 · Publicado 2023-12-14 · Atualizado 2023-12-18 · CVE-2023-45182

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions IBM i Access Client Solutions versions 1.1.2 through 1.1.4 IBM i Access Client Solutions versions 1.1.4.3 through 1.1.9.3

Description The issue allows a local attacker to obtain the password to other systems by decoding the key for an encrypted password. This can be achieved if the attacker gains access to the encrypted password.

Recommendations For versions 1.1.2 through 1.1.4, consider updating to a version outside of this range to mitigate the risk. For versions 1.1.4.3 through 1.1.9.3, consider updating to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the encrypted password storage to minimize the risk of exploitation.

Correção

Insecure Storage of Sensitive Information

Enumeração de Fraquezas

CWE-922

Identificadores relacionados

CVE-2023-45182

Produtos afetados

Ibm I Access Client Solutions

Referências · 8

• https://twitter.com/CVEnew/status/1735302401886654580 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-45182 · Aviso do Fabricante
• https://t.me/cvenotify/63988 · Publicação no Telegram
• https://t.me/cvenotify/63702 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-45182 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/268265 · Nota
• https://ibm.com/support/pages/node/7091942 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1735326144105173107 · Publicação no Twitter