Interpretation Conflict in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - CVE-2024-56339

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU113085

Interpretation Conflict in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - CVE-2024-56339

Published: July 21, 2025


Vulnerability identifier: #VU113085
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-56339
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can bypass security restrictions caused by a failure to honor security configuration. 


Affected software

IBM WebSphere Application Server
IBM WebSphere Application Server Liberty
IBM Tivoli Network Manager (ITNM)
Enterprise Application Runtimes
Operations Analytics - Log Analysis
PowerVM NovaLink
WebSphere Hybrid Edition
Cloud Pak for Applications
IBM Tivoli Netcool Configuration Manager
Engineering Test Management
Tivoli Composite Application Manager for Application Diagnostics
Maximo Application Suite - Monitor Component
IBM OpenPages with Watson
Maximo Application Suite - Predict Component
Verify Identity Access Digital Credentials
DevOps Code ClearCase
Business Automation Insights
Application Modernization Accelerator
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
Storage Protect Operations Center
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect Client
Storage Protect for Space Management
CICS Transaction Gateway for Multiplatforms
CICS Transaction Gateway Desktop Edition
IBM supplied MQ Advanced container images
Voice Gateway
Jazz for Service Management
IBM Cloud Transformation Advisor
IBM Tivoli System Automation Application Manager
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Control
IBM Sterling Partner Engagement Manager
IBM Tivoli Netcool Impact
IBM Spectrum Symphony
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
IBM TXSeries for Multiplatforms
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite
WebSphere Remote Server
IBM Rational ClearQuest
IBM Rational ClearCase
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM MQ Operator
IBM Maximo Application Suite - Manage Component
IBM Cloud Pak System
IBM Tivoli Application Dependency Discovery Manager
IBM Security Verify Access
IBM InfoSphere Information Server
IBM CICS TX Advanced
IBM CICS TX Standard
IBM Cognos Controller

How to mitigate CVE-2024-56339

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 9.0.5.26, 9.0.5.25
IBM WebSphere Application Server Liberty - update to 25.0.0.8
Voice Gateway - addressed in versions 1.0.8.17, 1.0.8.21
PowerVM NovaLink - addressed in versions 2.1.1-251007, 2.2.1.1-251007, 2.3.1-251007
IBM Cloud Transformation Advisor - update to 4.4.0
IBM Cloud Pak System - update to 2.3.6.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.0
IBM Spectrum Control - update to 5.4.13.2
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
IBM Tivoli Netcool Impact - update to 7.1.0.37
IBM Spectrum Symphony - update to 7.3.2 FP3
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.19
IBM Maximo Application Suite - addressed in versions 8.10.29, 8.11.26, 9.0.15, 9.1.3
Maximo Application Suite - Monitor Component - addressed in versions 8.10.26, 8.11.24, 9.0.16, 9.1.6
Maximo Application Suite - Predict Component - update to 9.1.1
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 1
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Business Automation Workflow - addressed in versions 24.0.0-IF007, 24.0.1-IF005, 25.0.0-IF002
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
IBM MQ Operator - addressed in versions 3.2.19, 3.7.2, 9.4.4.0-r3
Application Modernization Accelerator - update to 4.4.0
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.3.0
watsonx Assistant Cartridge - update to 5.3.0
Storage Protect Operations Center - update to 8.1.27.100
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.2.1
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.2.1
Storage Protect Client - update to 8.2.1
Storage Protect for Space Management - update to 8.2.1
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.30, 8.7.24, 9.0.17, 9.1.3
CICS Transaction Gateway for Multiplatforms - addressed in versions 9.2.0.2, 9.3.0.0, 10.1.0.0
CICS Transaction Gateway Desktop Edition - addressed in versions 9.2.0.2, 9.3.0.0, 10.1.0.0
IBM supplied MQ Advanced container images - update to 9.4.4.0-r3
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix42, 11.1.0.0 ifix34
IBM Cognos Controller - addressed in versions 11.0.1 FP7, 11.1.2 FP1
IBM CICS TX Standard - update to 11.1.0.0 ifix35

External References

Related Security Bulletins