SQL Injection Vulnerability in IBM Engineering Lifecycle Optimization - Publishing
CVE-2024-41767

7.3HIGH

Key Information:

Vendor
IBM
Status
Engineering Lifecycle Optimization Publishing
Vendor
CVE Published:
4 January 2025

Summary

The SQL injection vulnerability in IBM Engineering Lifecycle Optimization - Publishing affects versions 7.0.2 and 7.0.3. This security issue arises when a remote attacker exploits weaknesses in the application by sending specially crafted SQL statements. By doing so, the attacker may gain unauthorized access to the back-end database, potentially allowing them to view, add, modify, or delete critical information. Organizations using these versions are advised to apply the latest security patches and adopt best practices to mitigate the risks associated with SQL injection attacks.

Affected Version(s)

Engineering Lifecycle Optimization Publishing 7.0.2, 7.0.3

References

https://www.ibm.com/support/pages/node/7180199
vendor-advisory

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.