PT-2024-26331 · Ibm · Ibm Security Access Manager

Published 2024-06-28 · Updated 2024-07-31 · CVE-2024-35137

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager Docker versions 10.0.0.0 through 10.0.7.1

Description The issue allows a local user to possibly elevate their privileges due to sensitive configuration information being exposed.

Recommendations For versions 10.0.0.0 through 10.0.7.1, consider restricting access to sensitive configuration information to minimize the risk of exploitation. As a temporary workaround, review and secure the configuration to prevent potential privilege elevation.

Fix

Weakness Enumeration

CWE-258

CWE-521

Related Identifiers

CVE-2024-35137

Affected Products

Ibm Security Access Manager

References · 8

• https://osv.dev/vulnerability/CVE-2024-35137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35137 · Security Note
• https://ibm.com/support/pages/node/7158790 · Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Nov/0 · Note
• https://t.me/cvenotify/84795 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/292413 · Note
• https://t.me/cvenotify/84887 · Telegram Post
• https://t.me/cvenotify/88125 · Telegram Post