## Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including IBM Verify Identity Access Container 11.0 through 11.0.3, contain a format string injection vulnerability in the management interface. A malicious HTTP request can be crafted to trigger denial of service and information disclosure.
## Technical Details
- Vulnerability type: format string injection (CWE-134)
- Affected surface: management interface reachable over the network (HTTP)
- Attack prerequisites: attacker must be able to send a crafted HTTP request to the management interface
- Likely outcomes per NVD: DoS and information disclosure via the crafted request
- CVSS indicates:
- Network attack vector (AV:N)
- Low complexity (AC:L)
- Privileges required (PR:H)
- No user interaction (UI:N)
- Scope change (S:C)
- High impact on confidentiality and availability (C:H, A:H)
## Affected
- IBM Security Verify Access 10.0 through 10.0.9.2
- IBM Verify Identity Access 11.0 through 11.0.3
- IBM Verify Identity Access Container 11.0 through 11.0.3
## Impact
- Denial of service against the management interface
- Information disclosure resulting from the format string injection
- Potential scope impact consistent with CVSS (S:C)
## Mitigation
1. Apply the IBM security fix referenced in IBM’s advisory page 7283079 for IBM Verify Identity Access / IBM Security Verify Access.
2. Restrict network access to the management interface (allowlist trusted sources) to reduce exposure to crafted HTTP requests.
3. Monitor for anomalous management-interface HTTP requests consistent with format string injection attempts and investigate any resulting errors or unexpected disclosure indicators.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
CWE-134