IBM OpenPages Weak Encryption Algorithm Vulnerabilities (CVE-2024-49784/49753)

Critical Vulnerability Information Vulnerability Details CVE ID: CVE-2024-49784, CVE-2024-49753 Description: - IBM OpenPages may provide less security than expected, using AES encryption in CBC mode when storing encrypted data. If an authenticated remote attacker can access the database or server files, they may extract encrypted data values and potentially exploit this weakness by using other cryptographic methods to decrypt the data. - Specific issues include: - CWE-327: Use of a Broken or Insecure Cryptographic Algorithm - CWE-329: Generation of Predictable IV in CBC Mode CVSS Score CVE-2024-49784 - Base Score: 5.3 - Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) CVE-2024-49753 - Base Score: 5.3 一 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Affected Products and Versions IBM OpenPages 9.0 IBM OpenPages with Watson 8.3 Remediation For IBM OpenPages 9.0: - Download and install FixPack 5 or later - URL: https://www.ibm.com/support/pages/ibm-openpages-90-fixpack-5 For IBM OpenPages 8.3: - Download and install 8.3.0.3 and subsequent 8.3.0.3 Interim Fix 1 - URL: https://www.ibm.com/support/pages/openpages-watson-83-fixpack-3 - URL: https://www.ibm.com/support/pages/ibm-openpages-83-interim-fix-1 Workarounds and Mitigations No specific workarounds or mitigations available Additional Information Customers on v6.0.9.1/v6.2 are recommended to upgrade to supported 8.3 or 9.0 versions

Goal Reached Thanks to every supporter — we hit 100%!

IBM OpenPages Weak Encryption Algorithm Vulnerabilities (CVE-2024-49784/49753)