CVE-2021-38957 — Improper Input Validation in IBM Security Verify Access

CWE-20 — Improper Input Validation3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 56.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Security Verify Access
Timeline
PublishedJan 10
Latest updateJan 11

Description

IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive information due to hazardous input validation during QR code generation. IBM X-Force ID: 212040.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ibm/security_verify_access10.0.0, 10.0.1.0, 10.0.2.0+2
▶NVDibm/security_verify_access10.0.0, 10.0.1.0, 10.0.2.0+2

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-xrcc-x297-pm4c: IBM Security Verify 10↗2022-01-11
▶
CVEList
CVE-2021-38957: IBM Security Verify 10↗2022-01-07
▶
CVE-2021-38957 — Improper Input Validation in IBM | cvebase