Lucene search

IBM20BF41B22EC0BE8A72D08B1F88087858C27BE2996F8D960165C803C16E3A9DE4

HistoryAug 20, 2024 - 3:51 p.m.

Security Bulletin: IBM Global Configuration Management - Vulnerable to archiving a global baseline by an authenticated user having improper access controls

2024-08-2015:51:55

www.ibm.com

ibm

global configuration management

vulnerability

improper access controls

archiving

authenticated users

remediation

versions 7.0.2

7.0.3

ibm engineering lifecycle management

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

16.8%

JSON

Summary

IBM Global Configuration Management is vulnerable to archiving a global baseline by an authenticated user having improper access controls/permissions. This bulletin contains information regarding the vulnerability and remediation actions.

Vulnerability Details

CVEID:CVE-2024-41773
**DESCRIPTION:**IBM Global Configuration Management could allow an authenticated user to archive a global baseline due to improper access controls.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/350347 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
Global Configuration Management	7.0.3
Global Configuration Management	7.0.2

Remediation/Fixes

STEPS TO APPLY THE REMEDIATION:

Advising users who are on GCM 7.0, 7.0.1 or any other version below 7.0.2 to upgrade your products to Maintenance release 7.0.2 version as these products have reached end of life. Optionally, upgrade to the latest 7.0.3 version.

Affected Product(s)	Version(s)	Remediation/Fix/Instructions
Global Configuration Management	7.0.2	Download and install iFix030 or later
Global Configuration Management	7.0.3	Download and install iFix006 or later

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmibm_engineering_lifecycle_management_baseMatch702

ibmibm_engineering_lifecycle_management_baseMatch703

VendorProductVersionCPE
ibmibm_engineering_lifecycle_management_base702cpe:2.3:a:ibm:ibm_engineering_lifecycle_management_base:702:*:*:*:*:*:*:*
ibmibm_engineering_lifecycle_management_base703cpe:2.3:a:ibm:ibm_engineering_lifecycle_management_base:703:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	ibm_engineering_lifecycle_management_base	702	cpe:2.3:a:ibm:ibm_engineering_lifecycle_management_base:702:::::::*
ibm	ibm_engineering_lifecycle_management_base	703	cpe:2.3:a:ibm:ibm_engineering_lifecycle_management_base:703:::::::*

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

16.8%

JSON

Related for 20BF41B22EC0BE8A72D08B1F88087858C27BE2996F8D960165C803C16E3A9DE4