CVE-2023-35016
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing 'dot dot' sequences (/../) to view arbitrary files on the system.
Risk Assessment
The risk to the organization involves the potential for unauthorized access to sensitive files, which could lead to data exposure or further attacks.
Recommendation
It is recommended to update IBM Security Verify Governance, Identity Manager to the latest version and implement appropriate security measures to block unauthorized URL requests.
Other vulnerabilities in IBM Security Verify Governance, Identity Manager 10.0
See all- CVE-2025-36003High
IBM Security Verify Governance Identity Manager 10.0.2 may return detailed technical error messages that disclose sensitive system information. A remote attacker could use this information in further attacks against the system.
- CVE-2023-35019High
IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
Original NVD description (English source)
IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 257772.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS