PT-2024-31419 · Ibm · Webmethods Integration

Matthew Galligan · Published 2024-09-04 · Updated 2024-09-09 · CVE-2024-45075

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM webMethods Integration version 10.15

Description The issue allows an authenticated user to create scheduler tasks, enabling them to escalate their privileges to administrator due to missing authentication. This can lead to unauthorized access and control.

Recommendations For IBM webMethods Integration version 10.15, consider disabling the scheduler task creation feature for authenticated users until a patch is available to prevent privilege escalation. Restrict access to the scheduler module to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

CWE-308

Related Identifiers

CVE-2024-45075

Affected Products

Webmethods Integration

References · 14

• https://osv.dev/vulnerability/CVE-2024-45075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45075 · Security Note
• https://twitter.com/CVEnew/status/1831367380011798600 · Twitter Post
• https://ibm.com/support/pages/node/7167245 · Vendor Advisory, Patch
• https://twitter.com/AegisLens/status/1831467977536892971 · Twitter Post
• https://twitter.com/CveFindCom/status/1831369589172691346 · Twitter Post
• https://t.me/cvenotify/93311 · Telegram Post
• https://t.me/cvenotify/93597 · Telegram Post
• https://twitter.com/pravin_karthik/status/1833152539111600569 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1832238457080443238 · Twitter Post
• https://t.me/cvedetector/4805 · Telegram Post
• https://twitter.com/AegisLens/status/1832041567697129567 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1831414186435314075 · Twitter Post
• https://twitter.com/fletch_ai/status/1833385023019589952 · Twitter Post