PT-2025-1195 · Ibm · Ibm Concert

Published 2025-01-06 · Updated 2025-01-07 · CVE-2024-52891

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Concert Software versions 1.0.0 through 1.0.3

Description The issue is related to improper log neutralization, which could allow an authenticated user to inject malicious information or obtain information from log files. This is due to the incorrect handling of log registration outputs. Exploitation of the issue may enable a remote attacker to execute arbitrary commands.

Recommendations For versions 1.0.0 through 1.0.3, consider disabling log registration functionality until a patch is available to prevent malicious information injection or unauthorized access to log files. Restrict access to log files to minimize the risk of exploitation. As a temporary workaround, limit the ability of authenticated users to interact with log files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-117

Related Identifiers

BDU:2025-00552

CVE-2024-52891

Affected Products

Ibm Concert

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-52891 · Security Note
• https://ibm.com/support/pages/node/7180303 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00552 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52891 · Vendor Advisory
• https://twitter.com/CVEnew/status/1876606128311689497 · Twitter Post
• https://t.me/cvedetector/14529 · Telegram Post