CVE-2023-45191 is a high severity flaw in IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3, scored 7.5. The product uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. The shared IBM bulletin lists no patch. Read the IBM bulletin and apply the listed remedy.
What's affected
IBM bulletin node 7116045, first published on 7 February 2024, lists IBM Engineering Lifecycle Optimization versions 7.0.2 and 7.0.3 as affected. The NVD record for CVE-2023-45191 was published on 2024-02-09.
NVD scores the flaw 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. IBM publishes 7.5 on its bulletin, using CVSS 3.0 notation, so the two sources agree on the score. IBM also tracks it as X-Force ID 268755.
The shared IBM bulletin lists no patch. It says container authentication is not supported from 7.0.3 and advises using JTS authentication instead of Container authentication.
The NVD record names the product as IBM Engineering Lifecycle Optimization, while the IBM bulletin names the Publishing component. Use the bulletin as the narrower and more precise description.
Weakness class: CWE-307 (excessive authentication attempts).
How to check if you're exposed
Read the installed version of IBM Engineering Lifecycle Optimization from the application, in the About or system information page of the web console, and compare it with 7.0.2 and 7.0.3.
Then check how users sign in. The bulletin ties this CVE and two sibling issues (CVE-2023-45187, CVE-2023-45190 and CVE-2023-45191) to container authentication on the server. If your deployment uses Container authentication, you are in the group IBM warns about; if it uses JTS authentication, you are on the path IBM recommends.
What to do now
- Find every deployment of IBM Engineering Lifecycle Optimization 7.0.2 or 7.0.3.
- Switch the deployment from Container authentication to JTS authentication, as the IBM bulletin advises.
- Follow the IBM instructions linked from the bulletin for the authentication change, and test sign in and sign out afterwards.
- For the lockout issue, review account lockout settings in your identity configuration and enable alerts on repeated failed sign ins.
- Subscribe to IBM security bulletins for the product so you hear about future fixes.
Why it matters
Excessive authentication attempts, tracked as CWE-307, means the application does not slow down or stop repeated password guesses. Without a proper lockout, an attacker can try many passwords against an account.
The score matters less than the context. A 7.5 rating reflects the effect on confidentiality if an account falls to guessing. Strong passwords and sign in alerts reduce the risk even before the change is made. CVE-2023-45191 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
Quick check
What is the fix for CVE-2023-45191?
IBM lists no patch in the shared bulletin. It says to use JTS authentication instead of Container authentication.
Which versions are affected by CVE-2023-45191?
7.0.2 and 7.0.3 of IBM Engineering Lifecycle Optimization, per the IBM bulletin.
Sources
- Gold entry for CVE-2023-45191
- IBM security bulletin
- IBM X-Force entry 268755 (page did not render when fetched)
Last reviewed: 19 October 2026.
