by Kastro
Paper/Archive/CVE-2024-45647

CVE-2024-45647

IBM Security Verify Access — IBM Security Verify Access unverified password change

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
33
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 20.2.202 × 204.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password.

Affected

ProductAffectedFixed inSource
Security Verify Access10.0.0 – 10.0.8–CNA
Security Verify Access Docker10.0.0 – 10.0.8–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ibm (CNA)5.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refibm.com/support/pages/node/7176212