IBM Verify Access Root Escalation via Improper ACL (10.0.0.0-10.0.6.1)
CVE-2023-31003 Published on January 11, 2024
IBM Security Access Manager Container privilege escalation
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254658.
Vulnerability Analysis
CVE-2023-31003 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2023-31003 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2023-31003
stack.watch emails you whenever new vulnerabilities are published in IBM Security Verify Access or IBM Security Verify Access Docker. Just hit a watch button to start following.
Affected Versions
IBM Security Verify Access Appliance:- Version 10.0.0.0, <= 10.0.6.1 is affected.
- Version 10.0.0.0, <= 10.0.6.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.