PT-2024-1725 · Ibm · Ibm Security Verify Access Appliance+1

Published 2024-02-02 · Updated 2024-02-09 · CVE-2023-32327

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access Appliance versions 10.0.0.0 through 10.0.6.1 IBM Security Verify Access Docker versions 10.0.0.0 through 10.0.6.1

Description The issue is related to the incorrect restriction of XML external entity references in the IBM Security Verify Access Docker, which is part of the IBM Security Verify Access system. This can allow a remote attacker to conduct XML External Entity (XXE) attacks, potentially exposing sensitive information or consuming memory resources.

Recommendations For IBM Security Verify Access Appliance versions 10.0.0.0 through 10.0.6.1, update to a version that includes the fix for this issue. For IBM Security Verify Access Docker versions 10.0.0.0 through 10.0.6.1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting XML data processing to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2024-01431

CVE-2023-32327

Affected Products

Ibm Security Verify Access Appliance

Ibm Security Verify Access Docker

References · 9

• https://ibm.com/support/pages/node/7106586 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/254783 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01431 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-32327 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32327 · Vendor Advisory
• https://t.me/cvenotify/70395 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Nov/0 · Note
• https://twitter.com/VulmonFeeds/status/1753669321308393805 · Twitter Post
• https://vuldb.com/ru/?id.252793 · Note