IBM Verify Access Root Escalation via Improper ACL (10.0.0.0-10.0.6.1)
CVE-2023-31003 Published on January 11, 2024
IBM Security Access Manager Container privilege escalation
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254658.
Vulnerability Analysis
CVE-2023-31003 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2023-31003 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2023-31003
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-31003 are published in these products:
Affected Versions
IBM Security Verify Access Appliance:- Version 10.0.0.0, <= 10.0.6.1 is affected.
- Version 10.0.0.0, <= 10.0.6.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.