CVE-2023-32327: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. This vulnerability was assigned CVE-2023-32327 and was disclosed on February 2, 2024 (IBM Support).

The vulnerability is classified as an XML External Entity (XXE) injection vulnerability with a CVSS v3.1 Base Score of 7.1 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). The vulnerability is related to CWE-611 (Improper Restriction of XML External Entity Reference) (NVD).

A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. The vulnerability affects the confidentiality and availability of the system, with high impact on confidentiality and low impact on availability (IBM Support).

IBM encourages customers to update their systems promptly. For Docker Container users, obtain the latest version by running the command 'docker pull icr.io/isva/verify-access:[tag]'. For ISAM/ISVA appliances, obtain fix version 10.0.7-ISS-ISVA-FP0000 (IBM Support).