VulnerabilityModified

CVE-2023-45182

IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded.

MEDIUM 6.5EPSS 0.63%

Does this matter?

Lower severity and a low EPSS score (0.63%). Track it; it rarely justifies an emergency change on its own.

Description

IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow gaining access to the encrypted password, a local attacker could exploit this vulnerability to obtain the password to other systems. IBM X-Force ID: 268265.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS: 0.63% probability · 48th percentile
CISA KEV: Not listed
Weakness: CWE-922
Affected: ibm/i access client solutions
Source: psirt@us.ibm.com

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/268265VDB Entry
https://www.ibm.com/support/pages/node/7091942Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/268265VDB Entry
https://www.ibm.com/support/pages/node/7091942Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.