Lucene search

IbmCVE-2023-32338

HistorySep 05, 2023 - 12:15 a.m.

CVE-2023-32338

2023-09-0500:15:07

CWE-522

ibm

web.nvd.nist.gov

ibm

sterling

secure proxy

external authentication server

cve-2023-32338

nvd

security

vulnerability

user credentials

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

IBM Sterling Secure Proxy and IBM Sterling External Authentication Server 6.0.3 and 6.1.0 stores user credentials in plain clear text which can be read by a local user with container access. IBM X-Force ID: 255585.

Affected configurations

Nvd

Vulners

Node

ibmsterling_external_authentication_serverMatch6.0.3.0

ibmsterling_external_authentication_serverMatch6.1.0

ibmsterling_secure_proxyMatch6.0.3

ibmsterling_secure_proxyMatch6.1.0

VendorProductVersionCPE
ibmsterling_external_authentication_server6.0.3.0cpe:2.3:a:ibm:sterling_external_authentication_server:6.0.3.0:*:*:*:*:*:*:*
ibmsterling_external_authentication_server6.1.0cpe:2.3:a:ibm:sterling_external_authentication_server:6.1.0:*:*:*:*:*:*:*
ibmsterling_secure_proxy6.0.3cpe:2.3:a:ibm:sterling_secure_proxy:6.0.3:*:*:*:*:*:*:*
ibmsterling_secure_proxy6.1.0cpe:2.3:a:ibm:sterling_secure_proxy:6.1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	sterling_external_authentication_server	6.0.3.0	cpe:2.3:a:ibm:sterling_external_authentication_server:6.0.3.0:::::::*
ibm	sterling_external_authentication_server	6.1.0	cpe:2.3:a:ibm:sterling_external_authentication_server:6.1.0:::::::*
ibm	sterling_secure_proxy	6.0.3	cpe:2.3:a:ibm:sterling_secure_proxy:6.0.3:::::::*
ibm	sterling_secure_proxy	6.1.0	cpe:2.3:a:ibm:sterling_secure_proxy:6.1.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Sterling Secure Proxy",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "6.0.3, 6.1.0"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/255585

https://www.ibm.com/support/pages/node/7029765

www.ibm.com/support/pages/node/7029765

www.ibm.com/support/pages/node/7029766

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2023-32338