PT-2024-28653 · Ibm · Ibm Engineering Lifecycle Optimization - Engineering Insights

Published 2024-12-25 · Updated 2025-01-10 · CVE-2024-39727

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Engineering Lifecycle Optimization - Engineering Insights versions 7.0.2 through 7.0.3

Description The issue concerns the use of a web link with untrusted references to an external site, which could allow a remote attacker to expose sensitive information or perform unauthorized actions on the victim's web browser.

Recommendations For versions 7.0.2 and 7.0.3, consider disabling the web link feature that uses untrusted references to external sites until a patch is available. Restrict access to sensitive information and monitor for unauthorized actions on the web browser to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1022

Related Identifiers

CVE-2024-39727

Affected Products

Ibm Engineering Lifecycle Optimization - Engineering Insights

References · 7

• https://osv.dev/vulnerability/CVE-2024-39727 · Vendor Advisory
• https://ibm.com/support/pages/node/7176783 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39727 · Security Note
• https://t.me/cvedetector/13624 · Telegram Post
• https://t.me/cvenotify/105441 · Telegram Post
• https://twitter.com/CVEnew/status/1871922090372448588 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1871928650892726335 · Twitter Post