CVE-2024-35133— IBM Security Verify Access 输入验证错误漏洞

IBM Security Verify Access HTTP open redirect

IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

指向未可信站点的URL重定向(开放重定向)

IBM Security Verify Access 输入验证错误漏洞

IBM Security Verify Access（ISAM）是美国国际商业机器（IBM）公司的一款提高用户访问安全的服务。该服务通过使用基于风险的访问、单点登录、集成访问管理控制、身份联合以及移动多因子认证实现对Web、移动、IoT 和云技术等平台安全简单的访问 IBM Security Verify Access 10.0.0 版本到 10.0.8 版本存在输入验证错误漏洞，该漏洞源于 OIDC 提供商可能允许远程攻击者使用开放重定向攻击进行网络钓鱼攻击。

N/A

N/A