Security Bulletin: IBM Security Verify Access fixed a security vulnerability in the product.

Summary

IBM Security Verify Access with the advanced access control authentication service enabled could allow an attacker to authenticate as any user on the system.

Vulnerability Details

CVEID:CVE-2021-39070
**DESCRIPTION:**IBM Security Verify Access with the advanced access control authentication service enabled could allow an attacker to authenticate as any user on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215353 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

For the IBM Security Verify appliances

IBM Security Verify Access 10.0.0.0

|

10.0.3-ISS-ISVA-FP0000

IBM Security Verify Access ( Docker Container)

For Version 10.0.0.0

• Obtain the latest version of the container by running the following command “docker pull ibmcom/verify-access:[tag]”

Where [tag] is the latest published version and can be confirmed here

Workarounds and Mitigations

None