CVE-2024-45647: IBM Security Verify Access unverified password change
First published: Fri Nov 15 2024(Updated: )
IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Security Verify Access OIDC Provider | >=10.0.0<=10.0.8 | |
| IBM Security Verify Access | >=10.0.0<=10.0.8 | |
| IBM Security Verify Access OIDC Provider | <=10.0.X | |
| IBM Security Verify Access | <=10.0.X |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-45647?
CVE-2024-45647 is classified as a high severity vulnerability due to its ability to allow unverified users to change expired passwords.
How do I fix CVE-2024-45647?
To fix CVE-2024-45647, it is recommended to upgrade IBM Security Verify Access and IBM Security Verify Access Docker to version 10.0.9 or later.
What versions are affected by CVE-2024-45647?
CVE-2024-45647 affects IBM Security Verify Access versions 10.0.0 through 10.0.8 and IBM Security Verify Access Docker versions 10.0.0 through 10.0.8.
What impact does CVE-2024-45647 have on user accounts?
CVE-2024-45647 allows unauthorized users to reset the passwords of expired user accounts without prior knowledge of the current password.
Is there a workaround for CVE-2024-45647?
Currently, the primary resolution for CVE-2024-45647 is to upgrade to a non-affected version, as no workaround has been provided.
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/source
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/ibm-support
- source/IBM
- vendor/ibm
- canonical/ibm security verify access oidc provider
- version/ibm security verify access oidc provider/10.0.0
- version/ibm security verify access oidc provider/10.0.8
- canonical/ibm security verify access
- version/ibm security verify access/10.0.0
- version/ibm security verify access/10.0.8
- version/ibm security verify access oidc provider/10.0.x
- version/ibm security verify access/10.0.x