Lucene search

IBM017D57835E3D939F5F2D8DDB44B398392ED9AD98111F09617311381ABBAD82AC

HistoryAug 12, 2024 - 8:29 a.m.

Security Bulletin: IBM Maximo Application Suite uses Flask_Cors-4.0.0-py2.py3-none-any.whl which is vulnerable to CVE-2024-1681

2024-08-1208:29:30

www.ibm.com

ibm maximo

flask-cors

vulnerability

cve-2024-1681

log injection

cvss

remediation

version 9.0

version 8.11

version 8.10

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

7.2

Confidence

High

JSON

Summary

IBM Maximo Application Suite uses Flask_Cors-4.0.0-py2.py3-none-any.whl which is vulnerable to CVE-2024-1681. This bulletin contains information regarding the vulnerability and its fixture.

Vulnerability Details

CVEID:CVE-2024-1681
**DESCRIPTION:**Flask-CORS could allow a remote attacker to bypass security restrictions, caused by a log injection flaw when the log level is set to debug. By sending a specially crafted GET request containing a CRLF sequence in the request path, an attacker could exploit this vulnerability to confuse log post-processing tools, and forging log entries.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/289211 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Maximo Application Suite	9.0
IBM Maximo Application Suite	8.11
IBM Maximo Application Suite	8.10

Remediation/Fixes

Remediated Product(s)	Version(s)
IBM Maximo Application Suite	9.0.1
IBM Maximo Application Suite	8.11.13
IBM Maximo Application Suite	8.10.16

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmaximo_application_suiteMatch9.0

ibmmaximo_application_suiteMatch8.11

ibmmaximo_application_suiteMatch8.10

VendorProductVersionCPE
ibmmaximo_application_suite9.0cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*
ibmmaximo_application_suite8.11cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*
ibmmaximo_application_suite8.10cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	maximo_application_suite	9.0	cpe:2.3:a:ibm:maximo_application_suite:9.0:::::::*
ibm	maximo_application_suite	8.11	cpe:2.3:a:ibm:maximo_application_suite:8.11:::::::*
ibm	maximo_application_suite	8.10	cpe:2.3:a:ibm:maximo_application_suite:8.10:::::::*