IBM Security Verify Access v10.0.0.0-10.0.6.1 Remote Login via Empty Password
CVE-2023-43016 Published on February 3, 2024

IBM Security Access Manager Container unauthorized access
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote user to log into the server due to a user account with an empty password. IBM X-Force ID: 266154.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2023-43016 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
LOW

Weakness Type

Empty Password in Configuration File

Using an empty string as a password is insecure.


Products Associated with CVE-2023-43016

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-43016 are published in these products:

IBM Security Verify Access
 
IBM Security Verify Access Docker
 

Affected Versions

IBM Security Verify Access Appliance: IBM Security Verify Access Docker: ibm security_verify_access: ibm security_verify_access_docker:

Exploit Probability

EPSS
0.14%
Percentile
33.56%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.