CVE-2023-35888
MEDIUMIBM Security Verify Governance 10.0.2 - Sensitive Information Exposure via Missing HSTS Enforcement
Title source: llmDescription
IBM Security Verify Governance 10.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 258375.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
https://www.ibm.com/support/pages/node/7144228
Vendor Advisory vdb-entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/258375
Scores
CVSS v3
5.9
EPSS
0.0032
EPSS Percentile
23.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-311
Status
published
Products (1)
ibm/security_verify_governance
10.0.2
Published
Mar 20, 2024
Tracked Since
Feb 18, 2026