SB2024082842 - Multiple vulnerabilities in IBM Security Verify Directory
Published: August 28, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Inadequate Encryption Strength (CVE-ID: CVE-2022-32753)
The vulnerability allows a remote attacker in the adjacent network to gain access to potentially sensitive information.
The vulnerability exists due to IBM Security Verify Directory uses weaker than expected cryptographic algorithms. A remote attacker can gain unauthorized access to sensitive information on the system.
2) Information Exposure Through an Error Message (CVE-ID: CVE-2022-32756)
The vulnerability allows a remote privileged user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote privileged user can gain unauthorized access to sensitive information on the system when a detailed technical error message is returned in the browser.
3) Cross-site scripting (CVE-ID: CVE-2022-32754)
The disclosed vulnerability allows a remote privileged user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. The vulnerability allows privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install update from vendor's website.