CVE-2024-31874: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

IBM Security Verify Access Appliance versions 10.0.0 through 10.0.7 contains a vulnerability related to the use of uninitialized variables during deployment. This vulnerability was assigned CVE-2024-31874 and was discovered and reported by Pierre Barre. The vulnerability was initially disclosed on April 10, 2024 (IBM Advisory).

The vulnerability is classified under CWE-457 (Use of Uninitialized Variable) and CWE-908 (Use of Uninitialized Resource). It has received a CVSS v3.1 base score of 5.5 (MEDIUM) from NIST with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, while IBM Corporation assigned it a slightly higher CVSS score of 6.2 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability could allow a local user to cause a denial of service in IBM Security Verify Access Appliance. The impact primarily affects the availability of the system, as indicated by the CVSS metrics showing high impact on availability (IBM Advisory, NVD).

The vulnerability requires local access to exploit, with low attack complexity and no user interaction needed. According to the CVSS metrics, it can be exploited by an attacker with low privileges (NVD).

IBM strongly recommends that customers update their systems promptly. The updated libraries are available on the public GitHub repository at https://github.com/IBM-Security/ibmsecurity. No alternative workarounds or mitigations have been provided (IBM Advisory).