CVE-2023-31004: ibm security verify access Channel Accessible by Non-Endpoint

Vulnerability summary

CVE-2023-31004 is a critical (CVSS 9.0) Channel Accessible by Non-Endpoint vulnerability in ibm security verify access. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 61.9% of scored vulnerabilities.

Timeline

1. 03-02-2024
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote attacker to gain access to the underlying system using man in the middle techniques. IBM X-Force ID: 254765.

• CWE-300Channel Accessible by Non-EndpointThe product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.