CVE-2021-38957: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive information due to hazardous input validation during QR code generation (IBM Security Bulletin, CVE Mitre). The vulnerability was discovered and disclosed in January 2022.

The vulnerability is related to improper input validation during QR code generation processes. It has been assigned a CVSS Base score of 3.1, with a vector of (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N), indicating a network-accessible vulnerability with high attack complexity, requiring user interaction, and potentially resulting in low confidentiality impact (IBM Security Bulletin).

The vulnerability could lead to the disclosure of sensitive information. The impact is considered relatively low, as indicated by the CVSS scoring, affecting only the confidentiality aspect of the system with no impact on integrity or availability (IBM Security Bulletin).

IBM has released fixes for the vulnerability. For ISAM/ISVA appliances version 10.0.0.0, the fix is available in version 10.0.3-ISS-ISVA-FP0000. For container deployments, users should obtain the latest version of the container by running the command 'docker pull ibmcom/verify-access:[tag]' where [tag] is the latest published version (IBM Security Bulletin).