PT-2024-32410 · Ibm · Ibm I

Published 2024-12-18 · Updated 2025-07-03 · CVE-2024-47104

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM i versions 7.4 and 7.5

Description The issue allows an authenticated user to gain elevated privilege to a physical file. A user with authority to a view can alter the based-on physical file security attributes without having object management rights to the physical file. This can be exploited by a malicious actor to perform actions restricted by their view privileges.

Recommendations For IBM i versions 7.4 and 7.5, consider restricting access to views that are based on physical files to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the ability for users to alter physical file security attributes without object management rights. Restrict access to physical files to only those users who require it, based on the principle of least privilege.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2024-47104

Affected Products

Ibm I

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-47104 · Security Note
• https://ibm.com/support/pages/node/7179158 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47104 · Vendor Advisory
• https://t.me/cvedetector/13180 · Telegram Post
• https://t.me/cvenotify/127663 · Telegram Post
• https://t.me/cvenotify/104679 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1869345293323403542 · Twitter Post
• https://twitter.com/CVEnew/status/1869340054314799394 · Twitter Post