CVE-2024-22348: IBM UrbanCode Velocity cross-origin resource sharing
First published: Wed Oct 09 2024(Updated: )
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM UrbanCode | <=4.0.0 - 4.0.15 | |
| IBM DevOps Velocity | <=5.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-22348?
CVE-2024-22348 has been classified as a medium severity vulnerability due to potential unauthorized access to sensitive data.
How do I fix CVE-2024-22348?
To fix CVE-2024-22348, restrict CORS to only trusted domains in the configuration settings of IBM DevOps Velocity or IBM UrbanCode Velocity.
What software is affected by CVE-2024-22348?
CVE-2024-22348 affects IBM DevOps Velocity versions up to 5.0.0 and IBM UrbanCode Velocity versions from 4.0.0 to 4.0.15.
What type of attacks can CVE-2024-22348 allow?
CVE-2024-22348 can allow an attacker to execute privileged actions and retrieve confidential information due to improper CORS configuration.
Is CVE-2024-22348 required to be reported by compliance standards?
Yes, CVE-2024-22348 may need to be reported under various compliance standards that require organizations to mitigate vulnerabilities.
- agent/title
- agent/weakness
- agent/type
- agent/references
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/source
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm urbancode
- version/ibm urbancode/4.0.0 - 4.0.15
- canonical/ibm devops velocity
- version/ibm devops velocity/5.0.0