CVE-2024-38325
Published: 27 January 2025
Summary
CVE-2024-38325 is a medium-severity Missing Encryption of Sensitive Data (CWE-311) vulnerability in Ibm Storage Defender. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 17.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SC-8 (Transmission Confidentiality and Integrity).
Deeper analysis
CVE-2024-38325 affects IBM Storage Defender versions 2.0.0 through 2.0.7, specifically the on-prem defender-sensor-cmd CLI component. The vulnerability arises from the CLI sending network requests over an insecure channel, which could allow a remote attacker to obtain sensitive information. It is classified under CWE-311 (Missing Encryption of Sensitive Data) with a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating medium severity primarily due to high confidentiality impact.
A remote attacker with no privileges or user interaction required can exploit this vulnerability, though it demands high attack complexity, likely involving positioning for man-in-the-middle (MITM) techniques on the network path. Successful exploitation enables the attacker to intercept and obtain sensitive information transmitted by the CLI, without impacting integrity or availability.
For mitigation details, refer to the IBM security bulletin at https://www.ibm.com/support/pages/node/7168640, which provides information on patches and remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37104
Vulnerability details
IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI could allow a remote attacker to obtain sensitive information, caused by sending network requests over an insecure channel. An attacker could exploit this vulnerability to obtain sensitive information using man in…
more
the middle techniques.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing encryption enables MITM interception of sensitive data in transit (T1557 Adversary-in-the-Middle).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires protection of the confidentiality of sensitive information transmitted over networks by the defender-sensor-cmd CLI, directly preventing MITM interception via insecure channels.
Mandates cryptographic mechanisms to prevent unauthorized disclosure of sensitive data in transit, addressing the missing encryption in CLI network requests.
Ensures timely remediation of the specific software flaw in IBM Storage Defender CLI through patching, eliminating the insecure transmission vulnerability.