CVE-2024-31894: IBM App Connect Enterprise information disclosure
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288175.
Other sources
IBM App Connect Enterprise could allow an authenticated user to obtain sensitive user information using an expired access token.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31894?
CVE-2024-31894 has a moderate severity rating as it allows authenticated users to access sensitive information with an expired access token.
Who is affected by CVE-2024-31894?
CVE-2024-31894 affects users of IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.1.
How do I fix CVE-2024-31894?
To fix CVE-2024-31894, update to a version of IBM App Connect Enterprise that is 12.0.12.2 or later.
What type of access does CVE-2024-31894 exploit?
CVE-2024-31894 exploits access controls by allowing authenticated users to leverage expired tokens for information retrieval.
Is it safe to use IBM App Connect Enterprise versions 12.0.1.0 to 12.0.12.1 after the discovery of CVE-2024-31894?
Using IBM App Connect Enterprise versions 12.0.1.0 to 12.0.12.1 poses a security risk until the vulnerability is patched.