TI-2023-16714 Aliases CVE-2023-33836 GHSA-wj4x-x659-777v

IBM Security Verify Governance information disclosure

MEDIUM 43CWE-798Published 2023-10-16 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 256016.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00514 44th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	Security Verify Governance	10.0	—	No fix listed	CNA

Security Verify Governance VendorIBM Affected 10.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ibm:security_verify_governance::::::::	10.0 to before 10.0.2	Vulnerable	IBM

cpe:2.3:a:ibm:security_verify_governance:*:*:*:*:*:*:*:* Versions 10.0 to before 10.0.2 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-33836
2026-10-03 Alias added: GHSA-wj4x-x659-777v

References

Patch 1

https://www.ibm.com/support/pages/node/7047640

Advisory 1

https://https://exchange.xforce.ibmcloud.com/vulnerabilities/256016

TI-2023-17501 IBM Security Verify Governance command execution CVSS 3.1HIGH 8.8
TI-2023-16717 IBM Security Verify Governance command execution CVSS 3.1HIGH 8.8
TI-2022-06753 IBM Security Verify Governance information disclosure CVSS 3.1CRITICAL 9.8
TI-2022-06743 IBM Security Verify Governance Identity Manager 10.0 virtual appliance component performs… CVSS 3.1CRITICAL 9.8
TI-2024-14911 IBM Security Verify Governance information disclosure CVSS 3.1CRITICAL 9.8
TI-2025-24625 IBM Security Verify Governance Identity Manager information disclosure CVSS 3.1HIGH 7.5

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences