IBM UrbanCode Deploy Vulnerability: Impersonation of Another User After Logout
CVE-2024-22358

8.8HIGH

Key Information:

Vendor

IBM
Status
Urbancode Deploy
Devops Deploy
Vendor
CVE Published:
12 April 2024

What is CVE-2024-22358?

IBM UrbanCode Deploy and IBM DevOps Deploy exhibit a vulnerability wherein sessions are not properly invalidated after user logout. This oversight allows an authenticated user to potentially impersonate another user, compromising the security and integrity of the system. Administrators should ensure appropriate session handling practices to mitigate this issue.

Affected Version(s)

DevOps Deploy 8.0 <= 8.0.0.1

UrbanCode Deploy 7.0 <= 7.0.5.20

UrbanCode Deploy 7.1 <= 7.1.2.16

References

https://www.ibm.com/support/pages/node/7148109
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/280896
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.