CVE-2024-39746: IBM Sterling Connect:Direct Web Services information disclosure
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
Other sources
IBM Sterling Connect:Direct Web Services could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39746?
CVE-2024-39746 is considered a moderate severity vulnerability due to the potential exposure of sensitive information.
How can I fix CVE-2024-39746?
To fix CVE-2024-39746, it is recommended to apply the available patches from IBM for affected versions of Sterling Connect:Direct Web Services.
Which versions of Sterling Connect:Direct Web Services are affected by CVE-2024-39746?
CVE-2024-39746 affects IBM Sterling Connect:Direct Web Services versions 6.0 through 6.3.
Can CVE-2024-39746 be exploited remotely?
Yes, CVE-2024-39746 can potentially be exploited by a remote attacker to retrieve sensitive information.
What causes CVE-2024-39746?
CVE-2024-39746 is caused by the failure to properly enable HTTP Strict Transport Security in IBM Sterling Connect:Direct Web Services.