PT-2025-1196 · Ibm · Ibm Concert

Published 2025-01-06 · Updated 2025-01-07 · CVE-2024-52893

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Concert Software versions 1.0.0 through 1.0.3

Description The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. The vulnerability is related to shortcomings in the error reporting mechanism, which can be exploited by a remote attacker to gain unauthorized access to protected information.

Recommendations For versions 1.0.0 through 1.0.3, consider disabling the detailed technical error messages in the browser to minimize the risk of exploitation. Restrict access to sensitive information and error reports to authorized personnel only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2025-00553

CVE-2024-52893

Affected Products

Ibm Concert

References · 6

• https://bdu.fstec.ru/vul/2025-00553 · Security Note
• https://ibm.com/support/pages/node/7180303 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52893 · Security Note
• https://twitter.com/CVEnew/status/1876614718481432929 · Twitter Post
• https://t.me/cvedetector/14528 · Telegram Post