CVE-2024-35154

  1. Home
  2. Vulnerabilities
  3. CVE-2024-35154

IBM WebSphere Application Server code execution

CVSS v3.1 7.2 (High)
EPSS 0.06 % (31th)
Affected Products 1
Vulnerability EPSS SSVC STIX Affected Products Tools, Exploits & PoC Graph Social Timeline

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 292641.

Base Severity
High
Base Score
7.2
Impact Score
5.9
Exploitability Score
1.2
Metrics
Attack Vector (AV) Network
Attack Complexity (AC) Low
Privileges Required (PR) High
User Interaction (UI) None
Scope (S) Unchanged
Confidentiality (C) High
Integrity (I) High
Availability (A) High

Weaknesses

# ID Name
CWE-250 Execution with Unnecessary Privileges
For more information click on CWE ID.

CAPEC - Common Attack Pattern Enumeration and Classification

# ID Name Weakness
CAPEC-69 Target Programs with Elevated Privileges CWE-250
CAPEC-104 Cross Zone Scripting CWE-250
CAPEC-470 Expanding Control over the Operating System from the Database CWE-250
For more information click on CAPEC ID or CWE ID.

References

Source URL Tags
IBM Corporation https://exchange.xforce.ibmcloud.com/vulnerabilities/292641 VDB Entry Vendor Advisory
IBM Corporation https://www.ibm.com/support/pages/node/7159825 Vendor Advisory
CVE https://exchange.xforce.ibmcloud.com/vulnerabilities/292641 VDB Entry Vendor Advisory
CVE https://www.ibm.com/support/pages/node/7159825 Vendor Advisory
Modified
CVE Status
PUBLISHED
NVD Status
Modified
CNA
IBM Corporation
Published Date
2024-07-09 22:15:02
(6 months ago)
Updated Date
2024-11-21 09:19:50
(2 months ago)

View CVE-2024-35154 on ...

MITRE NVD CVE.org GitHub Security Advisory

Affected Vendors & Products

Ibm

For more detailed information see "Affected Products" section.

Configuration #1

    CPE v2.3 From Up To
  Ibm Websphere Application Server from 8.5.0.0 version and 8.5.5.25 and prior versions cpe:2.3:a:ibm:websphere_application_server >= 8.5.0.0 <= 8.5.5.25
  Ibm Websphere Application Server from 9.0.0.0 version and 9.0.5.20 and prior versions cpe:2.3:a:ibm:websphere_application_server >= 9.0.0.0 <= 9.0.5.20