CVE-2024-45673

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

I

BM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores user credentials in configuration files which can be read by a local user.

References

Link	Resource
https://www.ibm.com/support/pages/node/7183801	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:security_verify_bridge_directory_sync::::::::
	cpe:2.3:a:ibm:security_verify_gateway_for_radius::::::::
	cpe:2.3:a:ibm:security_verify_gateway_for_windows_login::::::::

OR	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

18 Jun 2025, 23:36

Type	Values Removed	Values Added
First Time		Ibm security Verify Gateway For Radius Microsoft windows Linux linux Kernel Ibm security Verify Gateway For Windows Login Ibm Microsoft Linux Ibm security Verify Bridge Directory Sync
CPE		cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:a:ibm:security_verify_gateway_for_windows_login:::::::: cpe:2.3:a:ibm:security_verify_bridge_directory_sync:::::::: cpe:2.3:a:ibm:security_verify_gateway_for_radius:::::::: cpe:2.3:o:microsoft:windows:-:::::::*
Summary		(es) IBM Security Verify Bridge Directory Sync 1.0.1 a 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 a 1.0.10 e IBM Security Verify Gateway for Radius 1.0.1 a 1.0.11 almacenan las credenciales de usuario en archivos de configuración que pueden ser leídos por un usuario local.
References	~~() https://www.ibm.com/support/pages/node/7183801 -~~	() https://www.ibm.com/support/pages/node/7183801 - Vendor Advisory

21 Feb 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-21 17:15

Updated : 2025-08-27 22:15

NVD link : CVE-2024-45673

Mitre link : CVE-2024-45673

CVE.ORG link : CVE-2024-45673

JSON object : View

Products Affected

windows

linux_kernel

CWE

CWE-260

Password in Configuration File

{"id": "CVE-2024-45673", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-02-21T17:15:12.900", "references": [{"url": "https://www.ibm.com/support/pages/node/7183801", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-260"}]}], "descriptions": [{"lang": "en", "value": "IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores user credentials in configuration files which can be read by a local user."}, {"lang": "es", "value": "IBM Security Verify Bridge Directory Sync 1.0.1 a 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 a 1.0.10 e IBM Security Verify Gateway for Radius 1.0.1 a 1.0.11 almacenan las credenciales de usuario en archivos de configuraci\u00f3n que pueden ser le\u00eddos por un usuario local."}], "lastModified": "2025-08-27T22:15:44.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_verify_bridge_directory_sync:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAEA73DA-1018-43D9-B4A2-3C971286ACF3", "versionEndIncluding": "1.0.12", "versionStartIncluding": "1.0.1"}, {"criteria": "cpe:2.3:a:ibm:security_verify_gateway_for_radius:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C104C5D2-1CD7-4005-9064-43F296809673", "versionEndIncluding": "1.0.11", "versionStartIncluding": "1.0.1"}, {"criteria": "cpe:2.3:a:ibm:security_verify_gateway_for_windows_login:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "901B7BA0-7493-403D-B0F2-57B1D1E340DE", "versionEndIncluding": "1.0.10", "versionStartIncluding": "1.0.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}