Spoofing attack in IBM WebSphere Application Server - CVE-2024-37532

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU94637

Spoofing attack in IBM WebSphere Application Server - CVE-2024-37532

Published: July 22, 2024


Vulnerability identifier: #VU94637
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-37532
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data. A remote user can spoof page content.


Affected software

IBM WebSphere Application Server
Engineering Test Management
Tivoli Composite Application Manager for Application Diagnostics
Business Monitor
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Rational ClearCase
Jazz for Service Management
IBM Tivoli System Automation Application Manager
IBM Maximo Asset Management
WebSphere Service Registry and Repository
WebSphere Remote Server
IBM Rational ClearQuest
IBM Security Verify Governance
InfoSphere Master Data Management
IBM Business Automation Workflow
IBM Tivoli Monitoring
IBM Cloud Pak System

How to mitigate CVE-2024-37532

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 8.5.5.26, 9.0.5.21
IBM Cloud Pak System - update to 2.3.4.1 iFix 1
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5

External References

Related Security Bulletins