Lucene search

IbmVULNRICHMENT:CVE-2024-31887

HistoryApr 16, 2024 - 9:18 p.m.

CVE-2024-31887 IBM Security Verify Privilege information disclosure

2024-04-1621:18:19

CWE-497

ibm

github.com

ibm

security verify

privilege

information disclosure

soap api

x-force id 287651

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

High

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

IBM Security Verify Privilege 11.6.25 could allow an unauthenticated actor to obtain sensitive information from the SOAP API. IBM X-Force ID: 287651.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:security_verify_privilege:11.6.25:*:*:*:*:*:*:*"
    ],
    "vendor": "ibm",
    "product": "security_verify_privilege",
    "versions": [
      {
        "status": "affected",
        "version": "11.6.25"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/287651

www.ibm.com/support/pages/node/7148438

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

High

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-31887