CVE-2024-39746: IBM Sterling Connect:Direct Web Services information disclosure
First published: Wed Aug 21 2024(Updated: )
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Sterling Connect:Direct | <=6.3.0 | |
| IBM Sterling Connect:Direct | <=6.1.0 | |
| IBM Sterling Connect:Direct | <=6.2.0 | |
| IBM Sterling Connect:Direct | <=6.0 | |
| All of | ||
| Any of | ||
| IBM Sterling Connect:Direct | =6.0 | |
| IBM Sterling Connect:Direct | =6.1.0 | |
| IBM Sterling Connect:Direct | =6.2.0 | |
| IBM Sterling Connect:Direct | =6.3.0 | |
| Any of | ||
| IBM AIX | ||
| Linux Kernel | ||
| Microsoft Windows Operating System |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-39746?
CVE-2024-39746 is considered a moderate severity vulnerability due to the potential exposure of sensitive information.
How can I fix CVE-2024-39746?
To fix CVE-2024-39746, it is recommended to apply the available patches from IBM for affected versions of Sterling Connect:Direct Web Services.
Which versions of Sterling Connect:Direct Web Services are affected by CVE-2024-39746?
CVE-2024-39746 affects IBM Sterling Connect:Direct Web Services versions 6.0 through 6.3.
Can CVE-2024-39746 be exploited remotely?
Yes, CVE-2024-39746 can potentially be exploited by a remote attacker to retrieve sensitive information.
What causes CVE-2024-39746?
CVE-2024-39746 is caused by the failure to properly enable HTTP Strict Transport Security in IBM Sterling Connect:Direct Web Services.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- vendor/ibm
- canonical/ibm sterling connect:direct
- version/ibm sterling connect:direct/6.3.0
- version/ibm sterling connect:direct/6.1.0
- version/ibm sterling connect:direct/6.2.0
- version/ibm sterling connect:direct/6.0
- canonical/ibm aix
- vendor/linux
- canonical/linux kernel
- vendor/microsoft
- canonical/microsoft windows operating system