PT-2024-34640 · Ibm · Ibm I

Hyp3Rlinx + 1 · Published 2024-12-21 · Updated 2025-07-03 · CVE-2024-51464

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3, 7.4, and 7.5

Description The issue allows an authenticated attacker to bypass Navigator for i interface restrictions by sending a specially crafted request, enabling them to remotely perform operations that the user is not allowed to perform when using Navigator for i.

Recommendations For IBM i versions 7.3, 7.4, and 7.5, consider restricting access to the Navigator for i interface until a patch is available. As a temporary workaround, consider disabling the interface or limiting its functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

CWE-644

Related Identifiers

CVE-2024-51464

Affected Products

Ibm I

References · 14

• 🔥 https://exploit-db.com/exploits/52210 · Exploit
• https://osv.dev/vulnerability/CVE-2024-51464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51464 · Security Note
• https://ibm.com/support/pages/node/7179509 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1870477587396313245 · Twitter Post
• https://t.me/cvedetector/13505 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Dec/20 · Note
• http://seclists.org/fulldisclosure/2024/Dec/19 · Note
• https://t.me/cvenotify/105244 · Telegram Post
• https://twitter.com/syedaquib77/status/1912228696607387834 · Twitter Post
• https://t.me/cvenotify/105442 · Telegram Post
• https://t.me/cvenotify/105802 · Telegram Post
• https://twitter.com/CVEnew/status/1870466858110816707 · Twitter Post
• https://t.me/cvenotify/127665 · Telegram Post