CVE-2023-38368: 
IBM Security Access Manager (ISAM) vulnerability analysis and mitigation

CVE-2023-38368 affects IBM Security Access Manager Docker versions 10.0.0.0 through 10.0.7.1. The vulnerability could allow disclosure of sensitive information to a local user due to improper permission controls (IBM Security Bulletin).

The vulnerability has been assigned a CVSS Base score of 6.2 with a vector string of CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The weakness is categorized as CWE-863 (Incorrect Authorization) (IBM Security Bulletin).

If exploited, this vulnerability could lead to the disclosure of sensitive information to local users of the IBM Security Access Manager Docker container. The vulnerability specifically impacts the confidentiality of the system, with high potential for information disclosure, while not affecting integrity or availability (IBM Security Bulletin).

The vulnerability requires local access (AV:L) with low attack complexity (AC:L) and no privileges (PR:N) or user interaction (UI:N) to exploit (IBM Security Bulletin).

IBM has released version 10.0.8.0 to address this vulnerability. Users are encouraged to update their systems promptly by obtaining the latest version of the container using the command 'docker pull icr.io/isva/verify-access:[tag]' where [tag] is the latest published version. For ISAM/ISVA appliances, users should obtain and install fix 10.0.8-ISS-ISVA-FP0000 (IBM Security Bulletin).