Security Bulletin: IBM Common Licensing is affected by a Weak Password Policy vulnerability (CVE-2024-40697)

Summary

IBM LKS Administration and Reporting Tool and Administration Agent does not require that users should have passwords of defined length by default, which makes it easier for attackers to compromise user accounts. This has been addressed in remediation section.

Vulnerability Details

CVEID:CVE-2024-40697
**DESCRIPTION:**IBM Common Licensing does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/297895 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Download and apply Interim Fix Pack IBM_Common_Licensing_ICL_9.0.0.1 from Fix Central

Users are strongly advised to update to the latest version (IBM Common Licensing 9.0.0.1) to mitigate any potential risks associated with this vulnerability.

Workarounds and Mitigations

None