Incomplete Revocation of Permissions Vulnerability Affects IBM UrbanCode Deploy and DevOps Deploy
CVE-2024-22334

4.4MEDIUM

Key Information:

Vendor
IBM
Status
Urbancode Deploy
Devops Deploy
Vendor
CVE Published:
12 April 2024

Summary

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type. When deleting a custom security type, associated permissions of objects using that type may not be fully revoked. This could lead to incorrect reporting of permission configuration and unexpected privileges being retained. IBM X-Force ID: 279974.

Affected Version(s)

DevOps Deploy 8.0 <= 8.0.0.1

UrbanCode Deploy 7.0 <= 7.0.5.20

UrbanCode Deploy 7.1 <= 7.1.2.16

References

https://www.ibm.com/support/pages/node/7148112
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/279974
vdb-entry

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.