Input validation error in cookie - CVE-2024-47764
Published: October 17, 2024
Vulnerability identifier: #VU98760
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-47764
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
cookie
watsonx.data
console
Guardium Data Security Center (GDSC)
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Security QRadar EDR
Application Modernization Accelerator
Cognos Dashboards on Cloud Pak for Data
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
QRadar Log Source Management App
Db2 Big SQL
Business Automation Insights
Netcool Operations Insight
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Business Automation Workflow
IBM Cloud Pak for Security
IBM Process Mining
Qradar Advisor
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Cloud Transformation Advisor
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
IBM Maximo Application Suite
App Connect Enterprise Certified Container
IBM Cloud Pak for Business Automation
Cloud Pak for Data
IBM QRadar Data Synchronization App
IBM Cognos Controller
Event Streams
IBM App Connect Enterprise
Planning Analytics Local
QRadar Pulse App
IBM Security QRadar Analyst Workflow
IBM Security SOAR
HPE Unified OSS Console (UOC)
cookie
watsonx.data
console
Guardium Data Security Center (GDSC)
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Security QRadar EDR
Application Modernization Accelerator
Cognos Dashboards on Cloud Pak for Data
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
QRadar Log Source Management App
Db2 Big SQL
Business Automation Insights
Netcool Operations Insight
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Business Automation Workflow
IBM Cloud Pak for Security
IBM Process Mining
Qradar Advisor
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Cloud Transformation Advisor
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
IBM Maximo Application Suite
App Connect Enterprise Certified Container
IBM Cloud Pak for Business Automation
Cloud Pak for Data
IBM QRadar Data Synchronization App
IBM Cognos Controller
Event Streams
IBM App Connect Enterprise
Planning Analytics Local
QRadar Pulse App
IBM Security QRadar Analyst Workflow
IBM Security SOAR
HPE Unified OSS Console (UOC)
Detailed vulnerability description
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied cookies. A remote attacker can pass a specially crafted cookie to the application and alter values passed to the application.
How to mitigate CVE-2024-47764
Install updates from vendor's website.