CVE-2023-25681: ibm spectrum_virtualize Use of Single-factor Authentication

Vulnerability summary

CVE-2023-25681 is a medium (CVSS 6.5) Use of Single-factor Authentication vulnerability in ibm spectrum_virtualize. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.4% of scored vulnerabilities.

Timeline

1. 05-03-2024
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only username and password. This does not affect local users with MFA configured or remote users authenticating via single sign-on. IBM X-Force ID: 247033.

• CWE-308Use of Single-factor AuthenticationThe product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.