PT-2023-29448 · Ibm · Ibm I Access Client Solutions

Maksymilian Kubiak + 1 · Published 2023-12-14 · Updated 2023-12-18 · CVE-2023-45182

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions IBM i Access Client Solutions versions 1.1.2 through 1.1.4 IBM i Access Client Solutions versions 1.1.4.3 through 1.1.9.3

Description The issue allows a local attacker to obtain the password to other systems by decoding the key for an encrypted password. This can be achieved if the attacker gains access to the encrypted password.

Recommendations For versions 1.1.2 through 1.1.4, consider updating to a version outside of this range to mitigate the risk. For versions 1.1.4.3 through 1.1.9.3, consider updating to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the encrypted password storage to minimize the risk of exploitation.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2023-45182

Affected Products

Ibm I Access Client Solutions

References · 8

• https://osv.dev/vulnerability/CVE-2023-45182 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45182 · Security Note
• https://ibm.com/support/pages/node/7091942 · Vendor Advisory
• https://twitter.com/CVEnew/status/1735302401886654580 · Twitter Post
• https://t.me/cvenotify/63988 · Telegram Post
• https://t.me/cvenotify/63702 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/268265 · Note
• https://twitter.com/VulmonFeeds/status/1735326144105173107 · Twitter Post