CVE-2023-31001: IBM Security Access Manager Container information disclosure
First published: Tue Jan 09 2024(Updated: )
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254653.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Security Verify Access OIDC Provider | >=10.0.0.0<10.0.0.7 | |
| IBM Security Verify Access | >=10.0.0.0<10.0.0.7 | |
| IBM Security Verify Access | <=10.0.0.0 - 10.0.6.1 | |
| IBM Security Verify Access | <=10.0.0.0 - 10.0.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-31001?
CVE-2023-31001 is classified as a moderate severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2023-31001?
To mitigate CVE-2023-31001, upgrade to versions of IBM Security Access Manager Container beyond 10.0.6.1.
What types of software are affected by CVE-2023-31001?
CVE-2023-31001 affects IBM Security Verify Access Appliance and IBM Security Verify Access Docker versions 10.0.0.0 through 10.0.6.1.
What information is temporarily stored due to CVE-2023-31001?
CVE-2023-31001 involves the temporary storage of sensitive information in files, making it accessible to local users.
Who is responsible for addressing CVE-2023-31001?
It is the responsibility of the organization using affected IBM products to address the vulnerabilities associated with CVE-2023-31001.
- agent/references
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/author
- agent/remedy
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/ibm-support
- source/IBM
- vendor/ibm
- canonical/ibm security verify access oidc provider
- version/ibm security verify access oidc provider/10.0.0.0
- canonical/ibm security verify access
- version/ibm security verify access/10.0.0.0
- version/ibm security verify access/10.0.0.0 - 10.0.6.1