CVE-2023-35016
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing 'dot dot' sequences (/../) to view arbitrary files on the system.
Risk Assessment
The risk to the organization involves the potential for unauthorized access to sensitive files, which could lead to data exposure or further attacks.
Recommendation
It is recommended to update IBM Security Verify Governance, Identity Manager to the latest version and implement appropriate security measures to block unauthorized URL requests.
Original NVD description (English source)
IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 257772.