Security Bulletin: Security vulnerabilities have been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component

Summary

IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the following vulnerabilities

Vulnerability Details

CVEID:CVE-2022-22457
**DESCRIPTION:**IBM Security Verify Governance stores sensitive information including user credentials in plain clear text which can be read by a local privileged user.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225007 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N)

CVEID:CVE-2022-22449
**DESCRIPTION:**IBM Security Verify Identity Manager could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224915 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2022-22456
**DESCRIPTION:**IBM Security Verify Governance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 4.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225004 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)

CVEID:CVE-2022-22458
**DESCRIPTION:**IBM Security Verify Governance stores user credentials in plain clear text which can be read by a remote authenticated user.
CVSS Base score: 6.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225009 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

10.0.1.0-ISS-ISVG-IMVA-FP0003

Workarounds and Mitigations

None