CVE-2024-22348: IBM UrbanCode Velocity cross-origin resource sharing
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
Other sources
IBM UCV - UrbanCode Velocity uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22348?
CVE-2024-22348 has been classified as a medium severity vulnerability due to potential unauthorized access to sensitive data.
How do I fix CVE-2024-22348?
To fix CVE-2024-22348, restrict CORS to only trusted domains in the configuration settings of IBM DevOps Velocity or IBM UrbanCode Velocity.
What software is affected by CVE-2024-22348?
CVE-2024-22348 affects IBM DevOps Velocity versions up to 5.0.0 and IBM UrbanCode Velocity versions from 4.0.0 to 4.0.15.
What type of attacks can CVE-2024-22348 allow?
CVE-2024-22348 can allow an attacker to execute privileged actions and retrieve confidential information due to improper CORS configuration.
Is CVE-2024-22348 required to be reported by compliance standards?
Yes, CVE-2024-22348 may need to be reported under various compliance standards that require organizations to mitigate vulnerabilities.