PT-2024-10440 · Ibm · Ibm Security Verify Governance

Published 2024-10-07 · Updated 2025-01-29 · CVE-2023-35017

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Verify Governance 10.0.2 Identity Manager

Description The issue is related to the transmission of user credentials in clear text by the Identity Manager component, which could be obtained by an attacker using man-in-the-middle techniques. This could allow a remote attacker to intercept and exploit the credentials. The vulnerability is associated with the storage of service data in an open manner.

Recommendations For IBM Security Verify Governance 10.0.2 Identity Manager, consider disabling the transmission of user credentials in clear text until a patch is available. Restrict access to sensitive data and minimize the risk of exploitation by implementing additional security measures, such as encryption and secure communication protocols.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-315

CWE-319

Related Identifiers

BDU:2025-00979

CVE-2023-35017

Affected Products

Ibm Security Verify Governance

References · 8

• https://ibm.com/support/pages/node/7172423 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35017 · Security Note
• https://bdu.fstec.ru/vul/2025-00979 · Security Note
• https://t.me/cvenotify/108936 · Telegram Post
• https://t.me/cvedetector/16662 · Telegram Post
• https://t.me/cvenotify/108932 · Telegram Post
• https://twitter.com/CVEnew/status/1884405815525925306 · Twitter Post