CVE-2024-45673

IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores user credentials in configuration files which can be read by a local user.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7183801	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:security_verify_bridge_directory_sync::::::::
	cpe:2.3:a:ibm:security_verify_gateway_for_radius::::::::
	cpe:2.3:a:ibm:security_verify_gateway_for_windows_login::::::::

OR	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

18 Jun 2025, 23:36

Type	Values Removed	Values Added
Summary		(es) IBM Security Verify Bridge Directory Sync 1.0.1 a 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 a 1.0.10 e IBM Security Verify Gateway for Radius 1.0.1 a 1.0.11 almacenan las credenciales de usuario en archivos de configuración que pueden ser leídos por un usuario local.
References	~~() https://www.ibm.com/support/pages/node/7183801 -~~	() https://www.ibm.com/support/pages/node/7183801 - Vendor Advisory
CPE		cpe:2.3:a:ibm:security_verify_gateway_for_windows_login:::::::: cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:ibm:security_verify_gateway_for_radius:::::::: cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:a:ibm:security_verify_bridge_directory_sync::::::::
First Time		Ibm Ibm security Verify Bridge Directory Sync Linux Ibm security Verify Gateway For Windows Login Linux linux Kernel Microsoft windows Microsoft Ibm security Verify Gateway For Radius

21 Feb 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-21 17:15

Updated : 2025-06-18 23:36

NVD link : CVE-2024-45673

Mitre link : CVE-2024-45673

CVE.ORG link : CVE-2024-45673

JSON object : View

Products Affected

ibm

security_verify_gateway_for_radius
security_verify_bridge_directory_sync
security_verify_gateway_for_windows_login

linux

linux_kernel

microsoft

windows

CWE

CWE-260

Password in Configuration File

{"id": "CVE-2024-45673", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-02-21T17:15:12.900", "references": [{"url": "https://www.ibm.com/support/pages/node/7183801", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-260"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-260"}]}], "descriptions": [{"lang": "en", "value": "IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores user credentials in configuration files which can be read by a local user."}, {"lang": "es", "value": "IBM Security Verify Bridge Directory Sync 1.0.1 a 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 a 1.0.10 e IBM Security Verify Gateway for Radius 1.0.1 a 1.0.11 almacenan las credenciales de usuario en archivos de configuraci\u00f3n que pueden ser le\u00eddos por un usuario local."}], "lastModified": "2025-06-18T23:36:20.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_verify_bridge_directory_sync:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAEA73DA-1018-43D9-B4A2-3C971286ACF3", "versionEndIncluding": "1.0.12", "versionStartIncluding": "1.0.1"}, {"criteria": "cpe:2.3:a:ibm:security_verify_gateway_for_radius:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C104C5D2-1CD7-4005-9064-43F296809673", "versionEndIncluding": "1.0.11", "versionStartIncluding": "1.0.1"}, {"criteria": "cpe:2.3:a:ibm:security_verify_gateway_for_windows_login:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "901B7BA0-7493-403D-B0F2-57B1D1E340DE", "versionEndIncluding": "1.0.10", "versionStartIncluding": "1.0.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}

5.5 /10