CVE-2024-35133: IBM Security Verify Access HTTP open redirect
IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Other sources
IBM Security Verify Access OIDC Provider could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35133?
The severity of CVE-2024-35133 is considered to be high due to its potential to enable phishing attacks through an open redirect.
How do I fix CVE-2024-35133?
To fix CVE-2024-35133, it is recommended to upgrade IBM Security Verify Access to version 10.0.9 or higher.
Who is affected by CVE-2024-35133?
CVE-2024-35133 affects users of IBM Security Verify Access versions 10.0.0 through 10.0.8 and its Docker counterpart.
What type of attack does CVE-2024-35133 enable?
CVE-2024-35133 enables remote authenticated attackers to conduct phishing attacks using open redirect techniques.
What products are impacted by CVE-2024-35133?
The impacted products for CVE-2024-35133 include IBM Security Verify Access and IBM Security Verify Access Docker from versions 10.0.0 to 10.0.8.