IBM Verify Dir 10.0.0 Weak Crypto Enables Decryption
CVE-2022-32753 Published on March 22, 2024

IBM Security Verify Directory 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 228444.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Inadequate Encryption Strength

The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.


Products Associated with CVE-2022-32753

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2022-32753 are published in IBM Security Verify Directory:

IBM Security Verify Directory
 

Affected Versions

IBM Security Verify Directory Version 10.0.0 is affected by CVE-2022-32753

Exploit Probability

EPSS
0.01%
Percentile
2.11%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.