CVE-2024-45673: IBM Security Verify Bridge information disclosure
First published: Thu Feb 20 2025(Updated: )
IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores user credentials in configuration files which can be read by a local user.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Security Verify Bridge Directory Sync | <=1.0.1 - 1.0.12 | |
| IBM Security Verify Gateway | <=1.0.1 - 1.0.10 | |
| IBM Security Verify Gateway | <=1.0.1 - 1.0.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-45673?
The severity of CVE-2024-45673 is considered high due to the exposure of sensitive user credentials.
How do I fix CVE-2024-45673?
To fix CVE-2024-45673, update to the latest version of the affected IBM products where user credentials are not stored in readable configuration files.
Which IBM products are affected by CVE-2024-45673?
CVE-2024-45673 affects IBM Security Verify Bridge Directory Sync versions 1.0.1 to 1.0.12, IBM Security Verify Gateway for Windows Login versions 1.0.1 to 1.0.10, and IBM Security Verify Gateway for Radius versions 1.0.1 to 1.0.11.
What type of information is exposed in CVE-2024-45673?
CVE-2024-45673 exposes user credentials stored in configuration files that can be accessed by local users.
Is there a risk of privilege escalation with CVE-2024-45673?
Yes, CVE-2024-45673 poses a risk of privilege escalation as local users can access sensitive credentials.
- collector/nvd-api
- source/NVD
- agent/references
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/source
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/softwarecombine
- agent/tags
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm security verify bridge directory sync
- version/ibm security verify bridge directory sync/1.0.1 - 1.0.12
- canonical/ibm security verify gateway
- version/ibm security verify gateway/1.0.1 - 1.0.10
- version/ibm security verify gateway/1.0.1 - 1.0.11