Lucene search

[email protected]NVD:CVE-2024-22358

HistoryApr 12, 2024 - 5:17 p.m.

CVE-2024-22358

2024-04-1217:17:22

CWE-613

[email protected]

web.nvd.nist.gov

ibm urbancode deploy

session invalidation

user impersonation

ibm devops deploy

ibm x-force id

authenticated user

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

6.1

Confidence

High

EPSS

Percentile

9.0%

JSON

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 280896.

References

exchange.xforce.ibmcloud.com/vulnerabilities/280896

www.ibm.com/support/pages/node/7148109