CVE-2024-35139: 
IBM Security Access Manager (ISAM) vulnerability analysis and mitigation

IBM Security Access Manager Docker versions 10.0.0.0 through 10.0.7.1 contains a vulnerability that could allow a local user to obtain sensitive information from the container due to incorrect default permissions (IBM Advisory, NVD). The vulnerability was discovered and disclosed on June 28, 2024, and is tracked as CVE-2024-35139 with IBM X-Force ID: 292415.

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) by NIST NVD, while IBM Corporation assessed it with a slightly higher score of 6.2 MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The vulnerability is classified under CWE-276 (Incorrect Default Permissions) (NVD).

The vulnerability allows a local user to obtain sensitive information from the container. The impact is primarily focused on confidentiality, with no direct impact on integrity or availability of the system (IBM Advisory).

The vulnerability requires local access to the system for exploitation. No authentication is required according to IBM's assessment, though the NVD indicates that low privileges are needed (NVD).

IBM has released version 10.0.8.0 to address this vulnerability. Users are encouraged to update their systems promptly. For Docker Container installations, users should obtain the latest version by running the command 'docker pull icr.io/isva/verify-access:[tag]' where [tag] is the latest published version (IBM Advisory).