CVE-2021-20498: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. The vulnerability was discovered and disclosed in July 2021, identified as CVE-2021-20498. This information disclosure vulnerability affects IBM Security Verify Access Docker version 10.0.0 (IBM Advisory).

The vulnerability has a CVSS v3 Base Score of 5.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, has unchanged scope, and can impact confidentiality at a low level with no impact on integrity or availability (AttackerKB).

The exposure of version information through HTTP requests could enable attackers to gather intelligence about the system's configuration. This information could potentially be leveraged to plan and execute more targeted attacks against the affected system (IBM Advisory).

The vulnerability requires no privileges or user interaction to exploit, making it relatively straightforward to access. The attack vector is network-based, meaning it can be exploited remotely (AttackerKB).

IBM has released a fix for this vulnerability in version 10.0.2.0 of the IBM Security Verify Access Docker container. Users are advised to update to the latest version by pulling the updated container from Docker Hub using the command: docker pull ibmcom/verify-access:10.0.2.0 (IBM Advisory).