Lucene search

IbmVULNRICHMENT:CVE-2024-45074

HistorySep 04, 2024 - 4:02 p.m.

CVE-2024-45074 IBM webMethods Integration directory traversal

2024-09-0416:02:16

CWE-22

ibm

github.com

ibm

webmethods

integration

directory traversal

vulnerability

authenticated user

system

attacker

url request

dot dot sequences

arbitrary files

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

19.8%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing “dot dot” sequences (/…/) to view arbitrary files on the system.

References

www.ibm.com/support/pages/node/7167245

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

19.8%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-45074