Input validation error in cookie - CVE-2024-47764

Vulnerability identifier: #VU98760

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-47764

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied cookies. A remote attacker can pass a specially crafted cookie to the application and alter values passed to the application.

cookie
watsonx.data
console
Guardium Data Security Center (GDSC)
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Security QRadar EDR
Application Modernization Accelerator
Cognos Dashboards on Cloud Pak for Data
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
QRadar Log Source Management App
Db2 Big SQL
Business Automation Insights
Netcool Operations Insight
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Business Automation Workflow
IBM Cloud Pak for Security
IBM Process Mining
Qradar Advisor
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Cloud Transformation Advisor
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
IBM Maximo Application Suite
App Connect Enterprise Certified Container
IBM Cloud Pak for Business Automation
Cloud Pak for Data
IBM QRadar Data Synchronization App
IBM Cognos Controller
Event Streams
IBM App Connect Enterprise
Planning Analytics Local
QRadar Pulse App
IBM Security QRadar Analyst Workflow
IBM Security SOAR
HPE Unified OSS Console (UOC)

Install updates from vendor's website.

cookie - update to 0.7.0
console - update to 1.7.2
Netcool Operations Insight - update to 1.6.15
IBM Fusion HCI - update to 2.10.0
Guardium Data Security Center (GDSC) - update to 3.6.1
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
Cloud Pak for Data - update to 5.2
Maximo Application Suite - IoT Component - addressed in versions 8.7.28, 8.8.24, 9.0.14, 9.1.5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.15, 8.11.13, 9.0.5, 9.1.0
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.13, 9.0.5
IBM App Connect Enterprise - addressed in versions 12.0.12.8, 13.0.1.1
IBM Cloud Pak for Security - update to 1.11.0.0
IBM Process Mining - update to 2.0.0 IF001
Planning Analytics Local - addressed in versions 2.0.0.101, 2.1.8
watsonx.data - update to 2.1
QRadar Pulse App - update to 2.2.16
Qradar Advisor - update to 2.6.6
IBM Security QRadar Analyst Workflow - update to 2.34.0
HPE Unified OSS Console (UOC) - update to 3.1.12
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.12
IBM QRadar Data Synchronization App - update to 3.2.1
Security QRadar EDR - update to 3.12.13
Application Modernization Accelerator - update to 4.0.1
IBM Cloud Transformation Advisor - update to 4.0.1
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
Cognos Dashboards on Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
IBM Decision Optimization for Cloud Pak for Data - update to 5.1
watsonx Assistant Cartridge - update to 5.1.3
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
QRadar Log Source Management App - update to 7.0.11
Db2 Big SQL - update to 7.8
IBM Maximo Application Suite - addressed in versions 8.10.21, 8.11.18, 9.0.7
IBM Cognos Controller - addressed in versions 11.0.1 FP7, 11.1.2 FP1
Event Streams - update to 11.6.1
App Connect Enterprise Certified Container - addressed in versions 12.0.7, 12.6.0
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
Business Automation Insights - update to 24.0.0.0.1
IBM Security SOAR - update to 51.0.4.1

• https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x
• https://github.com/jshttp/cookie/pull/167
• https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c

• Improper input validation in jshttp cookie
• Minio Console update for third-party npm packages
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Security QRadar Analyst Workflow
• IBM App Connect Enterprise Certified Container update for jshttp cookie
• IBM Security SOAR update for jshttp cookie
• Multiple vulnerabilities in IBM QRadar Log Source Management App
• Multiple vulnerabilities in HPE Unified OSS Console (UOC) and Unified OSS Console Assurance Monitoring (UOCAM)
• IBM Watson Discovery update for jshttp cookie
• Multiple vulnerabilities in Guardium Data Security Center
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• IBM watsonx.data update for jshttp cookie
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Maximo Application Suite
• IBM Edge Data Collector update for jshttp cookie
• IBM Maximo Application Suite - Monitor Component update for jshttp cookie
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM QRadar Pulse App
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in QRadar Advisor With Watson for IBM QRadar SIEM
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for jshttp cookie
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Fusion
• IBM Cloud Pak for Data update for cookie
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for cookie
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Controller
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• IBM Big SQL on Cloud Pak for Data update for cookie