PT-2024-10239 · Ibm · Ibm Devops Velocity+1

Published 2024-01-09 · Updated 2025-08-14 · CVE-2024-22348

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM DevOps Velocity version 5.0.0 IBM UrbanCode Velocity versions 4.0.0 through 4.0.25

Description The issue is related to the use of an untrusted cross-domain policy file, which could allow a remote attacker to gain unauthorized access to protected information and elevate their privileges. The software uses Cross-Origin Resource Sharing (CORS), which may permit an attacker to perform privileged actions and retrieve sensitive information because the domain name is not limited to only trusted domains.

Recommendations For IBM DevOps Velocity version 5.0.0, update to a version that limits the domain name to only trusted domains. For IBM UrbanCode Velocity versions 4.0.0 through 4.0.25, update to a version that limits the domain name to only trusted domains. As a temporary workaround, consider restricting access to the CORS feature until a patch is available.

Fix

Weakness Enumeration

CWE-942

Related Identifiers

BDU:2025-00619

CVE-2024-22348

Affected Products

Ibm Devops Velocity

Ibm Urbancode Velocity

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-22348 · Security Note
• https://ibm.com/support/pages/node/7172750 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22348 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00619 · Security Note
• https://t.me/cveNotify/132293 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1881435839005106246 · Twitter Post
• https://vuldb.com/?id.292633 · Note
• https://t.me/cvedetector/15903 · Telegram Post
• https://t.me/cvenotify/107946 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1881435839869095978 · Twitter Post
• https://twitter.com/CVEnew/status/1881398893104992573 · Twitter Post