CVE-2023-32327: IBM Security Access Manager Container XML external entity injection
First published: Tue Jan 09 2024(Updated: )
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 254783.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Security Verify Access OIDC Provider | >=10.0.0.0<=10.0.6.1 | |
| IBM Security Verify Access | >=10.0.0.0<=10.0.6.1 | |
| IBM Security Verify Access | <=10.0.0.0 - 10.0.6.1 | |
| IBM Security Verify Access | <=10.0.0.0 - 10.0.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-32327?
CVE-2023-32327 has a high severity rating due to its potential for remote exploitation via XML External Entity Injection.
How do I fix CVE-2023-32327?
To mitigate the impact of CVE-2023-32327, it is advised to upgrade IBM Security Access Manager and Docker to versions later than 10.0.6.1.
Which products are affected by CVE-2023-32327?
CVE-2023-32327 affects IBM Security Verify Access Appliance and IBM Security Verify Access Docker versions from 10.0.0.0 to 10.0.6.1.
What is an XML External Entity Injection (XXE) attack as related to CVE-2023-32327?
An XML External Entity Injection (XXE) attack allows an attacker to interfere with the processing of XML data, potentially leading to unauthorized access or data exposure.
Can CVE-2023-32327 be exploited remotely?
Yes, a remote attacker can exploit CVE-2023-32327 if the affected software is vulnerable and accessible.
- agent/references
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/title
- agent/author
- agent/severity
- agent/remedy
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/ibm-support
- source/IBM
- vendor/ibm
- canonical/ibm security verify access oidc provider
- version/ibm security verify access oidc provider/10.0.0.0
- version/ibm security verify access oidc provider/10.0.6.1
- canonical/ibm security verify access
- version/ibm security verify access/10.0.0.0
- version/ibm security verify access/10.0.6.1
- version/ibm security verify access/10.0.0.0 - 10.0.6.1