PT-2025-2827 · Ibm · Ibm App Connect Enterprise

Published 2025-01-18 · Updated 2025-01-18 · CVE-2024-49338

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 12.0.1.0 through 12.0.7.0 IBM App Connect Enterprise version 13.0.1.0

Description The issue allows a privileged user to obtain JMS credentials under certain configurations. This is related to improper management of sensitive trace data.

Recommendations For IBM App Connect Enterprise versions 12.0.1.0 through 12.0.7.0, consider restricting access to sensitive trace data to minimize the risk of exploitation. For IBM App Connect Enterprise version 13.0.1.0, consider restricting access to sensitive trace data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1323

Related Identifiers

CVE-2024-49338

Affected Products

Ibm App Connect Enterprise

References · 8

• https://ibm.com/support/pages/node/7175396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49338 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49338 · Vendor Advisory
• https://t.me/cvedetector/15805 · Telegram Post
• https://t.me/cvenotify/107868 · Telegram Post
• https://twitter.com/CVEnew/status/1880761180953760141 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1880642539201417572 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1880645803317903443 · Twitter Post