PT-2024-9964 · Ibm · Ibm Websphere Automation

Published 2024-12-29 · Updated 2025-01-04 · CVE-2024-54181

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Automation version 1.7.5

Description: The vulnerability in the IBM WebSphere Automation platform's Swagger interface is related to the failure to neutralize special elements used in operating system commands. This could allow a remote privileged user with authorized access to the Swagger UI to execute arbitrary code using specially crafted input.

Recommendations: For IBM WebSphere Automation version 1.7.5, consider disabling access to the Swagger UI until a patch is available to prevent potential exploitation. Restrict access to the system to minimize the risk of arbitrary code execution. Avoid using specially crafted input in the Swagger UI to prevent exploitation of this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-00078

CVE-2024-54181

Affected Products

Ibm Websphere Automation

References · 10

• https://ibm.com/support/pages/node/7179994 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00078 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-54181 · Security Note
• https://osv.dev/vulnerability/CVE-2024-54181 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1873737862589362309 · Twitter Post
• https://twitter.com/cracbot/status/1875059590393680073 · Twitter Post
• https://t.me/cvedetector/13933 · Telegram Post
• https://t.me/cvenotify/105747 · Telegram Post
• https://twitter.com/cracbot/status/1875421969543524512 · Twitter Post
• https://t.me/latest_high_impact_cve/1729 · Telegram Post