IBM10F0B9E0FE0019B2B96ABB8632DFF527E4F679BF77D1D3D18123E66BE9AD10A8Security Bulletin: IBM Maximo Application Suite - AI Broker Component includes urllib3-1.26.18-py2.py3-none-any.whl which is vulnerable to this CVE-2024-37891
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
Low
Summary
IBM Maximo Application Suite - AI Broker Componen includes urllib3-1.26.18-py2.py3-none-any.whl which is vulnerable to this CVE-2024-37891. This bulletin contains information regarding the vulnerability and its fixture.
Vulnerability Details
CVEID:CVE-2024-37891
**DESCRIPTION:**urllib3 could allow a remote authenticated attacker to obtain sensitive information, caused by the failure to strip the Proxy-Authorization header during cross-origin redirects. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 4.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/295053 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Maximo Application Suite - AI Broker | 1.0.0 |
Remediation/Fixes
| Affected Product(s) | Fix Pack Version(s) |
|---|---|
| IBM Maximo Application Suite - AI Broker | 1.0.1 |
Workarounds and Mitigations
None
Affected configurations
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
Low