CVE-2024-45076 | IBM webMethods Integration 10.15 could allow an authenticate… | CVSS 9.9 CRITICAL

Description

IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating system.

Metadata

CVE ID: CVE-2024-45076
State: PUBLISHED
Assigner: ibm
Reserved: 2024-08-21 19:10 UTC
Published: 2024-09-04 15:59 UTC
Last updated: 2024-09-04 18:29 UTC
Primary CWE: CWE-434
CWE-434 Unrestricted Upload of File with Dangerous Type
Vendor / Product: IBM / webMethods Integration
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
IBM	webMethods Integration	—	10.15

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	CWE-434 Unrestricted Upload of File with Dangerous Type

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (1)

https://www.ibm.com/support/pages/node/7167245