CVE-2023-38369

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-521

Affected software

Vendor	Product	Versions
IBM	Security Verify Access Appliance	>= 10.0.0.0, <= 10.0.6.1
IBM	Security Verify Access Docker	>= 10.0.0.0, <= 10.0.6.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/261196VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7106586Patch, Vendor Advisory
http://seclists.org/fulldisclosure/2024/Nov/0
https://exchange.xforce.ibmcloud.com/vulnerabilities/261196VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7106586Patch, Vendor Advisory

Timeline

Published: Feb 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-38374.8A vulnerability classified as problematic has been found in DedeBIZ 6.2.10. Affected is an unknown function of the file /admin/sys_sql_query CVE-2023-383706.5IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install mal CVE-2023-383717.5IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker CVE-2023-383727.5An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authoriz CVE-2023-383756.1IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri CVE-2023-383789.8The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code v CVE-2023-383797.5The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin passwor CVE-2023-38384.8A vulnerability classified as problematic was found in DedeBIZ 6.2.10. Affected by this vulnerability is an unknown functionality of the fil CVE-2023-383807.5A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 (incl. SIPLU CVE-2023-383818.8Cross-Site Request Forgery (CSRF) vulnerability in Cyle Conoly WP-FlyBox plugin <= 6.46 versions.CVE-2023-383829.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stou CVE-2023-383835.4Missing Authorization vulnerability in OnTheGoSystems Language allows Exploiting Incorrectly Configured Access Control Security Levels.This