CVE-2024-49779

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to bypass security restrictions, caused by improper validation and management of authentication cookies. By modifying the CSRF token and Session Id cookie parameters using the cookies of another user, a remote attacker could exploit this vulnerability to bypass security restrictions and gain unauthorized access to the vulnerable application.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7183541	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:openpages_with_watson::::::::
	cpe:2.3:a:ibm:openpages_with_watson::::::::

OR	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

11 Mar 2025, 13:55

Type	Values Removed	Values Added
CPE		cpe:2.3:a:ibm:openpages_with_watson:::::::: cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:o:linux:linux_kernel:-:::::::*
References	~~() https://www.ibm.com/support/pages/node/7183541 -~~	() https://www.ibm.com/support/pages/node/7183541 - Vendor Advisory
Summary		(es) IBM OpenPages con Watson 8.3 y 9.0 IBM OpenPages podría permitir a un atacante remoto eludir las restricciones de seguridad, causadas por una validación y gestión inadecuada de las cookies de autenticación. Al modificar los parámetros de la cookie de token CSRF y Session Id utilizando las cookies de otro usuario, un atacante remoto podría aprovechar esta vulnerabilidad para eludir las restricciones de seguridad y obtener acceso no autorizado a la aplicación vulnerable.
First Time		Linux linux Kernel Ibm openpages With Watson Linux Ibm Microsoft Microsoft windows

20 Feb 2025, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-20 12:15

Updated : 2025-03-11 13:55

NVD link : CVE-2024-49779

Mitre link : CVE-2024-49779

CVE.ORG link : CVE-2024-49779

JSON object : View

Products Affected

ibm

openpages_with_watson

linux

linux_kernel

microsoft

windows

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2024-49779", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-02-20T12:15:10.527", "references": [{"url": "https://www.ibm.com/support/pages/node/7183541", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages \n\ncould allow a remote attacker to bypass security restrictions, caused by improper validation and management of authentication cookies. By modifying the CSRF token and Session Id cookie parameters using the cookies of another user, a remote attacker could exploit this vulnerability to bypass security restrictions and gain unauthorized access to the vulnerable application."}, {"lang": "es", "value": "IBM OpenPages con Watson 8.3 y 9.0 IBM OpenPages podr\u00eda permitir a un atacante remoto eludir las restricciones de seguridad, causadas por una validaci\u00f3n y gesti\u00f3n inadecuada de las cookies de autenticaci\u00f3n. Al modificar los par\u00e1metros de la cookie de token CSRF y Session Id utilizando las cookies de otro usuario, un atacante remoto podr\u00eda aprovechar esta vulnerabilidad para eludir las restricciones de seguridad y obtener acceso no autorizado a la aplicaci\u00f3n vulnerable."}], "lastModified": "2025-03-11T13:55:21.797", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:openpages_with_watson:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F71A33D-AF4E-4480-A4C2-2C73DBA1B967", "versionEndExcluding": "8.3.0.3", "versionStartIncluding": "8.3"}, {"criteria": "cpe:2.3:a:ibm:openpages_with_watson:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C36C16B7-9740-4060-BCF4-3270CE3176B1", "versionEndExcluding": "9.0.0.5", "versionStartIncluding": "9.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}