Security Verify Directory
Monthly
IBM Security Verify Directory (Container) versions 10.0.0 through 10.0.0.3 accepts uploaded files without validating their type, so an administrator who is already authenticated with high privileges (CVSS vector PR:H - authentication requirements confirmed from the vector) can store a dangerous file on the appliance. The practical damage is not self-contained: the uploaded artifact must still be delivered to or retrieved by a victim before it can 'perform further attacks against the system,' which is why our independent assessment downgrades the realistic impact to partial (C:L/I:L/A:N) even though IBM assigned a 7.2 base score. Only the container distribution is affected, no public exploit code has been identified at time of analysis, and the EPSS score is 0.04% (11th percentile), indicating very low predicted exploitation activity.
IBM Security Verify Directory Container versions 10.0.0.0 through 10.0.3.1 contain a privilege escalation vulnerability allowing local users to execute arbitrary commands as root. The vulnerability stems from the application running with unnecessary elevated privileges, enabling authenticated local attackers to escalate permissions without user interaction. This is a high-severity local privilege escalation affecting containerized deployments of IBM's identity and access management solution.
IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Security Verify Directory 10.0 through 10.0.3 is vulnerable to a denial of service when sending an LDAP extended operation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Security Verify Directory (Container) versions 10.0.0 through 10.0.0.3 accepts uploaded files without validating their type, so an administrator who is already authenticated with high privileges (CVSS vector PR:H - authentication requirements confirmed from the vector) can store a dangerous file on the appliance. The practical damage is not self-contained: the uploaded artifact must still be delivered to or retrieved by a victim before it can 'perform further attacks against the system,' which is why our independent assessment downgrades the realistic impact to partial (C:L/I:L/A:N) even though IBM assigned a 7.2 base score. Only the container distribution is affected, no public exploit code has been identified at time of analysis, and the EPSS score is 0.04% (11th percentile), indicating very low predicted exploitation activity.
IBM Security Verify Directory Container versions 10.0.0.0 through 10.0.3.1 contain a privilege escalation vulnerability allowing local users to execute arbitrary commands as root. The vulnerability stems from the application running with unnecessary elevated privileges, enabling authenticated local attackers to escalate permissions without user interaction. This is a high-severity local privilege escalation affecting containerized deployments of IBM's identity and access management solution.
IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Security Verify Directory 10.0 through 10.0.3 is vulnerable to a denial of service when sending an LDAP extended operation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.