Input validation error in JSONPath - CVE-2024-21534

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU100117

Input validation error in JSONPath - CVE-2024-21534

Published: November 8, 2024 / Updated: November 29, 2024


Vulnerability identifier: #VU100117
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-21534
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected application.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can exploit the unsafe default usage of vm in Node and execute arbitrary code on the system.


Affected software

JSONPath
Netcool Operations Insight
IBM Cloud Pak for Security
IBM Process Mining
APEX Cloud Platform for Red Hat OpenShift
Red Hat OpenShift Dev Spaces
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Maximo Application Suite - AI Broker
QRadar Suite
IBM Cloud Pak for Multicloud Management
Knowledge Catalog Premium Cartridge
IBM Cloud Pak for Watson AIOps
watsonx Assistant for IBM Cloud Pak for Data
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
IBM App Connect Enterprise
Planning Analytics Local
IBM API Connect
Event Streams

How to mitigate CVE-2024-21534

Install updates from vendor's website.

JSONPath - update to 10.0.7
Netcool Operations Insight - update to 1.6.15
QRadar Suite - update to 1.10.27.0
Knowledge Catalog Premium Cartridge - update to 5.2
IBM App Connect Enterprise - addressed in versions 12.0.12.8, 12.0.12.12, 13.0.1.1, 13.0.3.0
IBM Process Mining - update to 1.15.0 IF004
Planning Analytics Local - addressed in versions 2.0.0.103, 2.1.10
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.02.00
Red Hat OpenShift Dev Spaces - update to 3.17.0
IBM Cloud Pak for Watson AIOps - update to 4.8.0
watsonx Assistant for IBM Cloud Pak for Data - update to 4.8.8
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.8.8
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
App Connect Enterprise Certified Container - addressed in versions 5.0.22, 12.0.6, 12.6.0
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
watsonx Assistant Cartridge - update to 5.1.3
IBM Maximo Application Suite - AI Broker - update to 9.0.3
IBM API Connect - update to 10.0.9.0
Event Streams - update to 11.5.2

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins