CVE-2024-22356
Ibm App Connect Enterprise 11.0.0.1 – 11.0.0.24
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2024-22356 is a medium-severity Improper Output Neutralization for Logs (CWE-117) vulnerability in Ibm App Connect Enterprise. Its CVSS base score is 4.9 (Medium).
Operationally, ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19917
Vulnerability Data
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.9.0 and IBM Integration Bus for z/OS 10.1 through 10.1.0.2store potentially sensitive information in log or trace files that could be read by a privileged user. IBM X-Force ID: 280893.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.2V1.2.1V1.2.3
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validating that output matches expected content directly mitigates failures to properly encode or escape data for its destination context.
Policy and procedures require sanitization and neutralization when generating audit logs to avoid injection issues.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices and coding standards directly require output sanitization for logs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards explicitly require correct output encoding and escaping to preserve message structure.
Security testing can detect log injection flaws but does not prevent them at the source.
Logging control directly requires proper log generation and handling, which mitigates improper output neutralization.
Monitoring activities rely on trustworthy logs but do not ensure log message integrity.
Secure SDLC includes coding standards that reduce log-related weaknesses but does not specifically address logging.
Application security requirements include explicit rules for safe output handling and encoding.