CVE-2024-54176

CWE-306 — Missing Authentication3 documents3 sources
Severity
6.5MEDIUM
EPSS
0.1%
top 77.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Devops DeployIBM Urbancode Deploy
Timeline
PublishedFeb 8

Description

IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and 7.3 through 7.3.2 could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDibm/devops_deploy8.0.0.0 — 8.0.1.5+1
▶NVDibm/urbancode_deploy7.0.0.0 — 7.0.5.26+3
▶CVEListV5ibm/devops_deploy8.0 — 8.0.1.4+1
▶CVEListV5ibm/urbancode_deploy7.0 — 7.0.5.25+3

🔴Vulnerability Details

2
CVEList
IBM UrbanCode Deploy missing authentication↗2025-02-08
▶
GHSA
GHSA-6f8w-f2r8-4fhv: IBM DevOps Deploy 8↗2025-02-08
▶
CVE-2024-54176 (MEDIUM CVSS 6.5) | IBM DevOps Deploy 8.0 through 8.0.1 | cvebase.io