PT-2024-4817 · Ibm · Ibm Infosphere Information Server

Rüveyda Durul Çiftci · Published 2024-06-30 · Updated 2024-07-31 · CVE-2024-31898

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7

Description: The issue is related to an error in handling user-controlled authorization keys, which could allow a remote attacker to disclose protected information or modify arbitrary data. It is also described as allowing an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.

Recommendations: For IBM InfoSphere Information Server version 11.7, consider restricting access to sensitive information and implementing additional authentication measures to prevent bypassing authentication using insecure direct object references. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2024-05341

CVE-2024-31898

Affected Products

Ibm Infosphere Information Server

References · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/288182 · Vendor Advisory
• https://ibm.com/support/pages/node/7158425 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31898 · Security Note
• https://bdu.fstec.ru/vul/2024-05341 · Security Note
• https://t.me/cvenotify/88102 · Telegram Post