Lucene search

IBMF5F222B6E56FF17860850BBD4CE7AACC39CF8C72D801BC66552CFBBF3E1CFFEC

HistoryJun 28, 2024 - 2:18 p.m.

Security Bulletin: IBM Master Data Management is vulnerable to identity spoofing caused by vulnerabilites in IBM WebSphere Application Server

2024-06-2814:18:08

www.ibm.com

ibm

master data management

vulnerability

identity spoofing

websphere application server

infosphere

security bulletin

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Summary

IBM Master Data Management version 11.6 and 12.0 is impacted by vulnerability to identity spoofing in WebSphere Application Server. IBM WebSphere Application Server is vulnerable to identity spoofing by an authenticated user due to improper signature validation.

Vulnerability Details

CVEID:CVE-2024-37532
**DESCRIPTION:**IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID: 294721.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/294721 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
InfoSphere Master Data Management	12.0
InfoSphere Master Data Management	11.6

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by following WebSphere Application Server security bulletin

Principal Product and Version(s)	Affected Supporting Product and Version	Affected Supporting Product Security Bulletin
InfoSphere Master Data Management v11.6, v12.0	IBM WebSphere Application Server version 8.5 and 9.0.	Security Bulletin: IBM WebSphere Application Server is vulnerable to identity spoofing (CVE-2024-37532)

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibminfosphere_master_data_managementMatch11.6

ibminfosphere_master_data_managementMatch12.0

CPENameOperatorVersion
ibm master data managementeq11.6
ibm master data managementeq12.0

CPE	Name	Operator	Version
	ibm master data management	eq	11.6
	ibm master data management	eq	12.0

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for F5F222B6E56FF17860850BBD4CE7AACC39CF8C72D801BC66552CFBBF3E1CFFEC