CVE-2024-22347
Published: 20 January 2025
Summary
CVE-2024-22347 is a medium-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Ibm Devops Velocity. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-22347 is a cryptographic weakness (CWE-327) in IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity versions 4.0.0 through 4.0.25, where weaker than expected cryptographic algorithms are used. This flaw could enable an attacker to decrypt highly sensitive information. The vulnerability carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating medium severity with high confidentiality impact but no integrity or availability effects.
A remote attacker with network access could potentially exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. Successful exploitation would allow decryption of highly sensitive data stored or transmitted by the affected software, compromising confidentiality.
IBM has published a security bulletin at https://www.ibm.com/support/pages/node/7172750 providing details on the issue and recommended mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19908
Vulnerability details
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Weak crypto flaw in a network-accessible IBM product directly enables remote exploitation of a public-facing application to decrypt sensitive data.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires NIST-approved cryptographic mechanisms to protect sensitive information from decryption using weak algorithms as in this CVE.
Mandates timely flaw remediation, including patching the affected IBM software versions to address the weak cryptographic algorithms.
Requires cryptographic protection of information at rest, mitigating decryption of sensitive data stored by the vulnerable software.