IBM Security Verify Access and Identity Access Docker Command Injection Vulnerability

A command injection vulnerability has been identified in IBM Security Verify Access and IBM Verify Identity Access Docker, specifically in versions 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0. This vulnerability allows an unauthenticated user to execute arbitrary commands with lower user privileges on the system, stemming from improper validation of user-supplied input.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands on the affected system, potentially allowing for further exploitation or manipulation of the system's functionality.

Remediation

Users are advised to update to IBM Security Verify Access Fixpack 10.0.9.0-IF3 or IBM Verify Identity Access Fixpack 11.0.1.0-IF1. Instructions for downloading these fixpacks are available on the IBM Support Fix Central website.