CVE-2024-35133: ibm security verify access Open Redirect
Vulnerability summary
CVE-2024-35133 is a high (CVSS 8.2) Open Redirect vulnerability in ibm security verify access. EPSS estimates a 1.76% chance of exploitation in the next 30 days, higher than 77.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 29-08-2024PublishedVulnerability first disclosed.
- 21-09-2024Last modifiedVulnerability information updated.
Description
IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA6.8MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:NDiffers
EPSS trend
Probability
1.76%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.76% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundIBM Security Verify Access 10.0.0 - Open Redirect during OAuth Flow
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Ibm2 products
- security verify access≥ 10.0.0, ≤ 10.0.8
- security_verify_access_docker≥ 10.0.0, ≤ 10.0.8
1 vendor · 2 products
References
2 links- www.ibm.com/support/pages/node/7166712Vendor Advisory