CVE-2023-45187 is a medium severity flaw in IBM Engineering Lifecycle Optimization Publishing 7.0.2 and 7.0.3, scored 6.3. The product does not invalidate the session after logout, which could allow an authenticated user to impersonate another user. IBM does not list a patch. Read the IBM bulletin and apply the listed remedy.
What's affected
IBM bulletin node 7116045, first published on 7 February 2024, lists IBM Engineering Lifecycle Optimization Publishing versions 7.0.2 and 7.0.3 as affected. The NVD record for CVE-2023-45187 was published on 2024-02-09.
NVD scores the flaw 6.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. IBM publishes 6.3 on its bulletin, using CVSS 3.0 notation, so the two sources agree on the score. IBM also tracks it as X-Force ID 268749.
IBM does not list a patch. Its bulletin says container authentication is not supported from 7.0.3 and tells customers not to use Container authentication but to use JTS authentication instead.
The NVD record names the product as IBM Engineering Lifecycle Optimization, while the IBM bulletin names the Publishing component. Use the bulletin as the narrower and more precise description.
Weakness class: CWE-613 (insufficient session expiration).
How to check if you're exposed
Read the installed version of IBM Engineering Lifecycle Optimization Publishing from the application, in the About or system information page of the web console, and compare it with 7.0.2 and 7.0.3.
Then check how users sign in. The bulletin ties this CVE and two sibling issues (CVE-2023-45187, CVE-2023-45190 and CVE-2023-45191) to container authentication on the server. If your deployment uses Container authentication, you are in the group IBM warns about; if it uses JTS authentication, you are on the path IBM recommends.
What to do now
- Find every deployment of IBM Engineering Lifecycle Optimization Publishing 7.0.2 or 7.0.3.
- Switch the deployment from Container authentication to JTS authentication, as the IBM bulletin advises.
- Follow the IBM instructions linked from the bulletin for the authentication change, and test sign in and sign out afterwards.
- For the lockout issue, review account lockout settings in your identity configuration and enable alerts on repeated failed sign ins.
- Subscribe to IBM security bulletins for the product so you hear about future fixes.
Why it matters
Insufficient session expiration, tracked as CWE-613, means a session stays valid after the user signs out. Anyone who gets hold of the session token can keep acting as that user. The risk is highest on shared machines and where tokens leak into logs or proxies.
The score matters less than the context. A 6.3 rating reflects that the user must already be authenticated, but impersonation in a requirements or publishing tool can expose documents and approval workflows. CVE-2023-45187 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
Quick check
What is the fix for CVE-2023-45187?
IBM lists no patch. It says to use JTS authentication instead of Container authentication.
Which versions are affected by CVE-2023-45187?
7.0.2 and 7.0.3 of IBM Engineering Lifecycle Optimization Publishing, per the IBM bulletin.
Sources
- Gold entry for CVE-2023-45187
- IBM security bulletin
- IBM X-Force entry 268749 (page did not render when fetched)
Last reviewed: 19 October 2026.
