PT-2025-7429 · Ibm · Ibm Openpages With Watson

Published 2025-02-19 · Updated 2025-03-11 · CVE-2024-49779

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0

Description The issue is caused by improper validation and management of authentication cookies, allowing a remote attacker to bypass security restrictions. By modifying the CSRF token and Session Id cookie parameters using the cookies of another user, a remote attacker could exploit this vulnerability to bypass security restrictions and gain unauthorized access to the vulnerable application.

Recommendations For IBM OpenPages with Watson versions 8.3 through 9.0, consider disabling the use of authentication cookies or restricting access to sensitive areas of the application until a patch is available. As a temporary workaround, avoid using the CSRF token and Session Id cookie parameters in authentication processes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2025-06812

CVE-2024-49779

Affected Products

Ibm Openpages With Watson

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-49779 · Security Note
• https://bdu.fstec.ru/vul/2025-06812 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49779 · Vendor Advisory
• https://twitter.com/CVEnew/status/1892559802502361312 · Twitter Post
• https://ibm.com/support/pages/node/7183541 · Vendor Advisory, Patch
• https://t.me/cvenotify/114207 · Telegram Post
• https://t.me/cvedetector/18540 · Telegram Post
• https://t.me/cvenotify/111865 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1892589325042209110 · Twitter Post