4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.5 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.0%
IBM App Connect Enterprise Certified Container Designer flows that use the calendly, square or docusign connector are vulnerable to loss of confidentiality when an access token expires and is refreshed. This bulletin provides patch information to address the reported vulnerability in the calendly, square and docusign connector. [CVE-2024-31893 CVE-2024-31894 CVE-2024-31895]
CVEID:CVE-2024-31895
**DESCRIPTION:**IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288176.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/288176 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVEID:CVE-2024-31894
**DESCRIPTION:**IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288175.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/288175 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVEID:CVE-2024-31893
**DESCRIPTION:**IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive calendar information using an expired access token. IBM X-Force ID: 288174.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/288174 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Affected Product(s) | Version(s) |
---|---|
App Connect Enterprise Certified Container | 5.0-lts |
App Connect Enterprise Certified Container | 7.1 |
App Connect Enterprise Certified Container | 7.2 |
App Connect Enterprise Certified Container | 8.0 |
App Connect Enterprise Certified Container | 8.1 |
App Connect Enterprise Certified Container | 8.2 |
App Connect Enterprise Certified Container | 9.0 |
App Connect Enterprise Certified Container | 9.1 |
App Connect Enterprise Certified Container | 9.2 |
App Connect Enterprise Certified Container | 10.0 |
App Connect Enterprise Certified Container | 10.1 |
App Connect Enterprise Certified Container | 11.0 |
App Connect Enterprise Certified Container | 11.1 |
App Connect Enterprise Certified Container | 11.2 |
App Connect Enterprise Certified Container | 11.3 |
App Connect Enterprise Certified Container | 11.4 |
App Connect Enterprise Certified Container | 11.5 |
IBM strongly suggests the following:
App Connect Enterprise Certified Container up to 11.5.0 (Continuous Delivery)
Upgrade to App Connect Enterprise Certified Container Operator version 11.6.0 or higher, and ensure that all DesignerAuthoring, IntegrationServer and IntegrationRuntime components are at 12.0.12.2-r1 or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect/containers_cd?topic=releases-upgrading-operator>
App Connect Enterprise Certified Container 5.0 LTS (Long Term Support)
Upgrade to App Connect Enterprise Certified Container Operator version 5.0.18 or higher, and ensure that all DesignerAuthoring and IntegrationServer components are at 12.0.12.2-r1-lts or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect-contlts?topic=releases-upgrading-operator>
None
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.5 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.0%