← back
CVE-2024-22348

IBM UrbanCode Velocity cross-origin resource sharing

CVSS 5.3 MEDIUMEPSS 0.3%CWE-942
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5.3EPSS 0.3%KEV nãoPoC —Patch —
Lifecycle
20 Jan 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
IBM · DevOps VelocityIBM · UrbanCode Velocity

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://www.ibm.com/support/pages/node/7172750