Directory Traversal Vulnerability in IBM Power Hardware Management Console
CVE-2024-56477

6.5MEDIUM

Key Information:

Vendor

IBM
Status
Power Hardware Management Console
Vendor
CVE Published:
14 February 2025

What is CVE-2024-56477?

The IBM Power Hardware Management Console version 10.3.1050.0 is susceptible to a directory traversal vulnerability that allows authenticated users to exploit the system. By crafting a specially designed URL request using 'dot dot' sequences (e.g., /../), an attacker can potentially access unauthorized files on the system, leading to the exposure of sensitive information.

Affected Version(s)

Power Hardware Management Console 10.3.1050.0

References

https://www.ibm.com/support/pages/node/7183224
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.