CVE-2023-43017: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

IBM Security Verify Access versions 10.0.0.0 through 10.0.6.1 contains a security vulnerability that could allow a privileged user to install a configuration file enabling unauthorized remote access. This vulnerability was assigned CVE-2023-43017 and IBM X-Force ID 266155. The vulnerability was disclosed and published on February 7, 2024 (IBM Advisory).

The vulnerability has been assessed with a CVSS v3.1 Base Score of 7.2 HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) by NIST NVD, while IBM Corporation rated it at 8.2 HIGH (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The vulnerability is related to improper certificate validation (CWE-295) (NVD).

If exploited, this vulnerability could allow a privileged attacker to install a configuration file that enables unauthorized remote access to the system. The vulnerability affects all components of confidentiality, integrity, and availability with high severity ratings (IBM Advisory, NVD).

IBM has released version 10.0.7-ISS-ISVA-FP0000 to address this vulnerability. For Docker Container deployments, users should update their systems by running the command 'docker pull icr.io/isva/verify-access:[tag]' with the latest published version. For ISAM/ISVA appliances, users should obtain and install the latest version from the official IBM support channels. No workarounds are available for this vulnerability (IBM Advisory).