IBMA18C22A41892C518C5F1D1769BA762FA10C125ECBEBA85A89894BC3360C6A75BSecurity Bulletin: IBM Maximo Application Suite - AI Broker component uses async-3.2.5.tgz which is vulnerable to this CVE-2024-39249
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
Summary
IBM Maximo Application Suite - AI Broker component includesasync-3.2.5.tgz which is vulnerable to this CVE-2024-39249. This bulletin contains information regarding the vulnerability and its fixture.
Vulnerability Details
CVEID:CVE-2024-39249
**DESCRIPTION:**Async is vulnerable to a denial of service, caused by the ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/297174 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Maximo Application Suite - AI Broker | 1.0.0 |
Remediation/Fixes
| Affected Product(s) | Fix Pack Version(s) |
|---|---|
| IBM Maximo Application Suite - AI Broker | 1.0.1 |
Workarounds and Mitigations
None
Affected configurations
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High