CVE-2024-22358 — Insufficient Session Expiration in IBM Devops Deploy

CWE-613 — Insufficient Session Expiration3 documents3 sources
Severity
8.8HIGHNVD
CNA6.3
EPSS
0.1%
top 79.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Devops DeployIBM Urbancode Deploy
Timeline
PublishedApr 12

Description

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 280896.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶NVDibm/devops_deploy8.0.0.0 — 8.0.1.0
▶NVDibm/urbancode_deploy7.0.0.0 — 7.0.5.21+3
▶CVEListV5ibm/devops_deploy8.0 — 8.0.0.1
▶CVEListV5ibm/urbancode_deploy7.0 — 7.0.5.20+3

🔴Vulnerability Details

2
GHSA
GHSA-46mj-7xpv-pprw: IBM UrbanCode Deploy (UCD) 7↗2024-04-12
▶
CVEList
IBM UrbanCode Deploy session fixation↗2024-04-12
▶
CVE-2024-22358 — Insufficient Session Expiration in IBM | cvebase