IBM Security Verify Access and Docker Username Enumeration Vulnerability

A vulnerability in IBM Security Verify Access Appliance and Docker versions 10.0 through 10.0.8 allows remote attackers to enumerate usernames. This issue arises from an observable response discrepancy related to disabled accounts, which can be exploited to infer the existence of certain usernames.

Impact

Exploitation of this vulnerability could lead to unauthorized username enumeration, allowing attackers to identify valid user accounts.

Remediation

Users are advised to update to IBM Security Verify Access version 10.0.9 or IBM Verify Identity Access version 11.0. Instructions for downloading these updates are available on the IBM Support website. For Docker users, log into IBM Cloud Registry and follow the update instructions provided in the IBM Verify Identity Access v11 support page.