PT-2025-7430 · Ibm · Ibm Openpages With Watson

Published 2025-02-19 · Updated 2025-03-11 · CVE-2024-49780

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0

Description The issue allows a remote attacker to traverse directories on the system. An attacker with privileges to perform Import Configuration could send a specially crafted http request containing "dot dot" sequences (/../) in the file name parameter used in Import Configuration to write files to arbitrary locations outside of the specified directory and possibly overwrite arbitrary files.

Recommendations For versions 8.3 and 9.0, consider disabling the Import Configuration feature until a patch is available to prevent directory traversal attacks. Restrict access to the Import Configuration module to minimize the risk of exploitation. Avoid using the file name parameter in the affected Import Configuration endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-06818

CVE-2024-49780

Affected Products

Ibm Openpages With Watson

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-49780 · Security Note
• https://bdu.fstec.ru/vul/2025-06818 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49780 · Vendor Advisory
• https://ibm.com/support/pages/node/7183541 · Vendor Advisory, Patch
• https://t.me/cvenotify/111862 · Telegram Post
• https://t.me/cvenotify/114222 · Telegram Post
• https://twitter.com/CVEnew/status/1892428179681231051 · Twitter Post
• https://t.me/cvedetector/18510 · Telegram Post
• https://twitter.com/UndercodeUpdate/status/1894552822194004077 · Twitter Post
• https://t.me/cvenotify/111854 · Telegram Post