Lucene search

IbmCVE-2024-35133

HistoryAug 29, 2024 - 5:15 p.m.

CVE-2024-35133

2024-08-2917:15:07

CWE-601

ibm

web.nvd.nist.gov

ibm security verify access

oidc provider

open redirect attack

vulnerability

phishing attacks

remote attacker

malicious web site

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

32.6%

JSON

IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

Affected configurations

Nvd

Vulners

Node

ibmsecurity_verify_accessRange10.0.0–10.0.8

ibmsecurity_verify_access_dockerRange10.0.0–10.0.8

VendorProductVersionCPE
ibmsecurity_verify_access*cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*
ibmsecurity_verify_access_docker*cpe:2.3:a:ibm:security_verify_access_docker:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	security_verify_access	*	cpe:2.3:a:ibm:security_verify_access::::::::
ibm	security_verify_access_docker	*	cpe:2.3:a:ibm:security_verify_access_docker::::::::

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:security_verify_access:10.0.8:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:security_verify_access_docker:10.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:security_verify_access_docker:10.0.8:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "Security Verify Access",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "10.0.8",
        "status": "affected",
        "version": "10.0.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Security Verify Access Docker",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "10.0.8",
        "status": "affected",
        "version": "10.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/291026

www.ibm.com/support/pages/node/7166712

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

32.6%

JSON

Related for CVE-2024-35133