Verify Identity Access Docker
Monthly
Local privilege escalation in IBM Security Verify Access and Verify Identity Access 10.0.x/11.0.x allows an authenticated local user to obtain root because a component executes with more privileges than required (CWE-250). The flaw affects bare-metal and Docker deployments across 10.0.0.0-10.0.9.0 and 11.0.0.0-11.0.1.0, is local-only (AV:L) and requires existing local credentials under the authoritative assessment, so it cannot be triggered remotely over the network. No public exploit was identified at time of analysis, and IBM has released a vendor patch/advisory.
Security Verify Access and its Docker deployment can be induced to execute malicious scripts sourced from outside the product's control sphere, affecting both interactive and containerized installations in the 10.0.0.0-10.0.9.0 and 11.0.0.0-11.0.1.0 ranges, including Verify Identity Access 11.0.1.0. IBM rates the issue 8.5, but the supplied CVSS vector's PR:N conflicts with the description's requirement for a locally authenticated user, so the authentication prerequisite should be confirmed. No public exploit identified at time of analysis.
Unauthenticated OS command injection in IBM Security Verify Access (including the Docker distribution and Verify Identity Access) versions 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 lets a remote attacker who can reach the affected management/runtime interface execute arbitrary operating-system commands with the privileges of a lower-privileged service account, scored CVSS 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Because the injected commands run as a non-root user, confidentiality, integrity and availability impact is limited per-request, but the foothold can be used as a pivot for further privilege escalation against the appliance or container. Impact is bounded to the listed version ranges; IBM has published a vendor fix, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in IBM Security Verify Access and Verify Identity Access 10.0.x/11.0.x allows an authenticated local user to obtain root because a component executes with more privileges than required (CWE-250). The flaw affects bare-metal and Docker deployments across 10.0.0.0-10.0.9.0 and 11.0.0.0-11.0.1.0, is local-only (AV:L) and requires existing local credentials under the authoritative assessment, so it cannot be triggered remotely over the network. No public exploit was identified at time of analysis, and IBM has released a vendor patch/advisory.
Security Verify Access and its Docker deployment can be induced to execute malicious scripts sourced from outside the product's control sphere, affecting both interactive and containerized installations in the 10.0.0.0-10.0.9.0 and 11.0.0.0-11.0.1.0 ranges, including Verify Identity Access 11.0.1.0. IBM rates the issue 8.5, but the supplied CVSS vector's PR:N conflicts with the description's requirement for a locally authenticated user, so the authentication prerequisite should be confirmed. No public exploit identified at time of analysis.
Unauthenticated OS command injection in IBM Security Verify Access (including the Docker distribution and Verify Identity Access) versions 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 lets a remote attacker who can reach the affected management/runtime interface execute arbitrary operating-system commands with the privileges of a lower-privileged service account, scored CVSS 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Because the injected commands run as a non-root user, confidentiality, integrity and availability impact is limited per-request, but the foothold can be used as a pivot for further privilege escalation against the appliance or container. Impact is bounded to the listed version ranges; IBM has published a vendor fix, and no public exploit code or confirmed active exploitation was identified at time of analysis.