IBM Analytics Content Hub Multiple CVEs Advisory

Critical Vulnerability Information Vulnerability Overview CVE ID: CVE-2024-38754, CVE-2024-38756, CVE-2024-38759, CVE-2024-38761, CVE-2024-38763, CVE-2024-38765, CVE-2024-38767, CVE-2024-38769, CVE-2024-38771, CVE-2024-38773 Affected Products: IBM Analytics Content Hub 2.4.0.0.2, 2.4.0.0.3, 2.4.0.0.4, 2.4.0.0.5, 2.4.0.0.6, 2.4.0.0.7, 2.4.0.0.8, 2.4.0.0.9, 2.4.0.0.10, 2.4.0.0.11, 2.4.0.0.12, 2.4.0.0.13, 2.4.0.0.14, 2.4.0.0.15, 2.4.0.0.16, 2.4.0.0.17, 2.4.0.0.18, 2.4.0.0.19, 2.4.0.0.20, 2.4.0.0.21, 2.4.0.0.22, 2.4.0.0.23, 2.4.0.0.24 Vulnerability Details CVE-2024-38754: - Description: IBM Analytics Content Hub contains multiple open-source software (OSS) components affected by a directory traversal vulnerability. - CVSS Base Score: 5.3 - CVSS Vector: [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N] CVE-2024-38756: - Description: IBM Analytics Content Hub may allow remote attackers to exploit this vulnerability by not validating the type of uploaded files, enabling malicious configuration streams to be loaded into the system, which could lead to further attacks. - CVSS Base Score: 7.5 - CVSS Vector: [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N] CVE-434: - Description: Files of unspecified type have dangerous types. - CVSS Base Score: 4.3 - CVSS Vector: [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N] CVE-2024-38761: - Description: IBM Analytics Content Hub may allow remote attackers to obtain information about the application framework, which could be used to reorganize and extract information from console technical error messages for future attacks. - CVSS Base Score: 4.3 - CVSS Vector: [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N] CVE-2024-38763: - Description: IBM Analytics Content Hub is at risk of information disclosure and further attacks due to the use of untrusted JavaScript source maps in the application, potentially allowing attackers to read and debug JavaScript. - CVSS Base Score: 5.3 - CVSS Vector: [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N] CVE-2024-38765: - Description: A time-of-check time-of-use (TOCTOU) race condition in Apache Tomcat leads to a race condition vulnerability. When default security settings are used, attackers can exploit this vulnerability to bypass security restriction parameter checks and access sensitive data. - CVSS Base Score: 9.8 - CVSS Vector: [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H] CVE-2024-38767: - Description: Path equivalence issue in Apache Commons Codec allows attackers to write arbitrary files to target locations via partial PUT requests. - CVSS Base Score: 9.1 - CVSS Vector: [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H] CVE-2024-38769: - Description: Input validation issue in Apache Commons Codec allows attackers to exploit this vulnerability to obtain sensitive information. - CVSS Base Score: 7.5 - CVSS Vector: [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N] Affected Products and Versions Affected Products: IBM Analytics Content Hub 2.4.0.0.2 to 2.4.0.0.24 Mitigation Measures It is strongly recommended to apply the latest security update: IBM Analytics Content Hub 2.4.0.0.25

Goal Reached Thanks to every supporter — we hit 100%!

IBM Analytics Content Hub Multiple CVEs Advisory