Security Bulletin: security vulnerabilities have been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component

Summary

IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the following vulnerabilities

Vulnerability Details

CVEID:CVE-2022-22453
**DESCRIPTION:**IBM Security Verify Identity Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Base score: 5.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224919 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2022-22450
**DESCRIPTION:**IBM Security Verify Identity Manager could allow a privileged user to upload a malicious file by bypassing extension security in an HTTP request.
CVSS Base score: 3.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224916 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2022-22452
**DESCRIPTION:**IBM Security Verify Identity Manager uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224918 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2022-22460
**DESCRIPTION:**IBM Security Verify Identity Manager contains sensitive information in the source code reposititory that could be used in further attacks against the system.
CVSS Base score: 3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225013 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Workarounds and Mitigations

None