Lucene search

IbmCVE-2024-22334

HistoryApr 12, 2024 - 5:17 p.m.

CVE-2024-22334

2024-04-1217:17:21

CWE-732

ibm

web.nvd.nist.gov

ibm urbancode deploy

vulnerability

permission revocation

custom security resource

ibm devops deploy

incomplete revocation

CVSS3

4.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

AI Score

4.6

Confidence

High

EPSS

Percentile

9.0%

JSON

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type. When deleting a custom security type, associated permissions of objects using that type may not be fully revoked. This could lead to incorrect reporting of permission configuration and unexpected privileges being retained. IBM X-Force ID: 279974.

Affected configurations

Vulners

Node

ibmurbancode_deployRange7.0–7.0.5.20

ibmurbancode_deployRange7.1–7.1.2.16

ibmurbancode_deployRange7.2–7.2.3.9

ibmurbancode_deployRange7.3–7.3.2.4

ibmdevops_deployRange8.0–8.0.0.1

VendorProductVersionCPE
ibmurbancode_deploy*cpe:2.3:a:ibm:urbancode_deploy:*:*:*:*:*:*:*:*
ibmdevops_deploy*cpe:2.3:a:ibm:devops_deploy:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	urbancode_deploy	*	cpe:2.3:a:ibm:urbancode_deploy::::::::
ibm	devops_deploy	*	cpe:2.3:a:ibm:devops_deploy::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "UrbanCode Deploy",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "7.0.5.20",
        "status": "affected",
        "version": "7.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.1.2.16",
        "status": "affected",
        "version": "7.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.2.3.9",
        "status": "affected",
        "version": "7.2",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.3.2.4",
        "status": "affected",
        "version": "7.3",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "DevOps Deploy",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "8.0.0.1",
        "status": "affected",
        "version": "8.0",
        "versionType": "semver"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/279974

www.ibm.com/support/pages/node/7148112

CVSS3

4.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

AI Score

4.6

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-22334