Cryptographic Weakness in IBM Security Verify Governance Identity Manager

CVE-2023-33838

What is CVE-2023-33838?

IBM Security Verify Governance, specifically version 10.0.2, is affected by a vulnerability due to the use of a one-way cryptographic hash for sensitive data, such as passwords, without incorporating a salt. This oversight reduces the effectiveness of the hashing mechanism, potentially exposing user credentials to reversible attacks. Proper cryptographic practices mandate the use of salts in conjunction with hashes to enhance security, and the absence of this can lead to increased risks for password-related exploits.

References