IBM i Access Client Solutions information disclosure
CVE-2023-45182

7.4HIGH

Key Information:

Vendor
IBM
Status
i Access Client Solutions
Vendor
CVE Published:
14 December 2023

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The IBM i Access Client Solutions versions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 contain a vulnerability that allows local attackers to decode the key for encrypted passwords. This flaw enables unauthorized access to the plaintext password, potentially compromising security on other connected systems. An exploitation of this vulnerability emphasizes the need for implementing strong security measures and regular updates to safeguard sensitive information.

Affected Version(s)

i Access Client Solutions 1.1.2 <= 1.1.4

i Access Client Solutions 1.1.4.3 <= 1.1.9.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-45182
Created by afine-com

References

https://www.ibm.com/support/pages/node/7091942
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/268265
vdb-entry

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.