Verify Directory
Monthly
Session fixation in IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 lets an attacker pre-establish a session identifier and, once an administrator authenticates into that same session, ride the authenticated context into the directory management console with full console privileges. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, base 8.8) rates confidentiality, integrity and availability impact as high, though the described mechanism inherently depends on a victim administrator completing login to the attacker-supplied session - a distinction reflected in the independent assessment, which scores PR:N/UI:R. A vendor patch is available per IBM's advisory; no public exploit code or CISA KEV entry is present in the supplied data, and the current priority decision is remediation this week.
Credential exposure in IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 occurs because authentication can be performed with GET requests, placing credentials in URL query parameters that are retained in browser history and server, proxy, or SIEM logs. An attacker who can read those recorded URLs could recover credentials, but the assessed vector (CVSS 6.5, PR:L) requires low privileges and the flaw does not bypass authentication or cause integrity or availability impact. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation.
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 expose debug endpoints that return server version details and session identifiers to low-privilege authenticated network users. The issue is limited to information disclosure (CVSS 4.3, C:L, with no integrity or availability impact), making version fingerprinting and reconnaissance the main consequence. No public exploit has been identified at time of analysis, and IBM has published a patch advisory.
Cross-site request forgery in IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 lets an attacker induce an authenticated user's browser to send unauthorized requests because session cookies lack the SameSite attribute. The issue is low severity (CVSS 3.5, integrity-only) and requires user interaction; no public exploit was identified at time of analysis, and a vendor patch is available per IBM's advisory.
Session fixation in IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 lets an attacker pre-establish a session identifier and, once an administrator authenticates into that same session, ride the authenticated context into the directory management console with full console privileges. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, base 8.8) rates confidentiality, integrity and availability impact as high, though the described mechanism inherently depends on a victim administrator completing login to the attacker-supplied session - a distinction reflected in the independent assessment, which scores PR:N/UI:R. A vendor patch is available per IBM's advisory; no public exploit code or CISA KEV entry is present in the supplied data, and the current priority decision is remediation this week.
Credential exposure in IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 occurs because authentication can be performed with GET requests, placing credentials in URL query parameters that are retained in browser history and server, proxy, or SIEM logs. An attacker who can read those recorded URLs could recover credentials, but the assessed vector (CVSS 6.5, PR:L) requires low privileges and the flaw does not bypass authentication or cause integrity or availability impact. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation.
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 expose debug endpoints that return server version details and session identifiers to low-privilege authenticated network users. The issue is limited to information disclosure (CVSS 4.3, C:L, with no integrity or availability impact), making version fingerprinting and reconnaissance the main consequence. No public exploit has been identified at time of analysis, and IBM has published a patch advisory.
Cross-site request forgery in IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 lets an attacker induce an authenticated user's browser to send unauthorized requests because session cookies lack the SameSite attribute. The issue is low severity (CVSS 3.5, integrity-only) and requires user interaction; no public exploit was identified at time of analysis, and a vendor patch is available per IBM's advisory.