CVE-2024-22348
Hcltech Devops Velocity 5.0.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-22348 is a medium-severity Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942) vulnerability in Hcltech Devops Velocity. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-22348 is a Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability affecting IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity versions 4.0.0 through 4.0.25. The flaw arises because the software does not limit the domain name to only trusted domains, enabling improper CORS policies. It has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and is associated with CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). The vulnerability was published on 2025-01-20.
An unauthenticated attacker with network access can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows the attacker to carry out privileged actions and retrieve sensitive information by bypassing intended CORS restrictions.
IBM has published a security bulletin at https://www.ibm.com/support/pages/node/7172750 providing details on the vulnerability, affected versions, and recommended mitigation steps, including applying available patches.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19909
Vulnerability Data
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to…
more
only trusted domains.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.3V3.4.6V3.5.2
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement requires approved authorizations and would reject policies permitting untrusted domains.
Boundary protection at external interfaces stops unauthorized cross-domain communication allowed by permissive policies.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes can surface permissive policy misconfigurations.
Hardened configuration baselines and reviews directly prevent permissive CSP or cross-domain policies.
Secure SDLC activities include review and testing of web security policies to avoid untrusted domains.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.
Security of network services includes defining allowed endpoints, which can limit untrusted domains but does not directly address web-client policy files.
Web filtering can block untrusted domains at the network level, partially mitigating permissive cross-domain policies.
A.8.26 only requires that security requirements (including resilience against attacks such as injections) be identified and specified during development or acquisition; it does not itself enforce, implement, or configure any cross-domain policy, CSP, or domain whitelist that would stop exploitation of a permissive policy allowing untrusted domains.
A.8.27 mandates security-by-design, defense-in-depth, least-privilege, assume-breach, distrust-external-input, and explicit review against known attack patterns (including permissive cross-domain policies); this stops exploitation in many but not all cases (e.g. when the policy is supplied by a third-party component or when the review misses a novel untrusted domain).
Secure coding practices require proper configuration of CSP and cross-domain policies to avoid untrusted domains.