CVE-2025-0163 - IBM Security Verify Access information disclosure

Back Back to CVE browser

MEDIUM

IBM Security Verify Access information disclosure

Published Jun 11, 2025

5.3

MEDIUM

CVSS 3.1

EPSS 0.34%

Description

IBM Security Verify Access Appliance and Docker 10.0 through 10.0.8 could allow a remote attacker to enumerate usernames due to an observable response discrepancy of disabled accounts.

Affected products

Vendor IBM Product Security Verify Access Default
unaffected
- Version
  10.0
  Status
  affected
  Constraints
  <=10.0.8
Vendor IBM Product Security Verify Access Docker Default
unaffected
- Version
  10.0
  Status
  affected
  Constraints
  <=10.0.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Security Verify Access

unaffected

Version	Status	Constraints
10.0	affected	<=10.0.8

IBM

Security Verify Access Docker

unaffected

Version	Status	Constraints
10.0	affected	<=10.0.8

Remediation

Vendor solution

IBM encourages customers to update their systems promptly.

Passport Advantage IBM Security Verify Access 10.0.9: https://www.ibm.com/support/pages/node/7177661 IBM Verify Identity Access 11.0: https://www.ibm.com/support/pages/node/7167873

Fix Central Product Name Fixed in VRMF

Fix availability IBM Security Verify Access 10.0.9 10.0.9-ISS-ISVA-FP0000 IBM Verify Identity Access 11.0 11.0.0-ISS-IVIA-FP0000

Docker Log into IBM Cloud Registry and then execute the corresponding commands as the following: https://www.ibm.com/support/pages/node/7167873#container

Weaknesses (1)

CWE-204