CVE-2024-38337
Published: 19 January 2025
Summary
CVE-2024-38337 is a critical-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Ibm Sterling Secure Proxy. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2024-38337 is a high-severity vulnerability (CVSS 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) affecting IBM Sterling Secure Proxy versions 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0. The issue stems from incorrect permission assignments (CWE-732), which could enable an unauthorized attacker to retrieve or alter sensitive information contents.
The vulnerability is exploitable remotely over the network by an unauthenticated attacker (PR:N) with low attack complexity and no user interaction required. Successful exploitation would grant high-impact access to confidential data (C:H) and allow modifications to it (I:H), without affecting availability (A:N), potentially leading to data breaches or unauthorized changes in a proxy environment handling secure communications.
IBM has published a security advisory with details on mitigation and patches at https://www.ibm.com/support/pages/node/7179166. Security practitioners should review it for version-specific remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37105
Vulnerability details
IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow an unauthorized attacker to retrieve or alter sensitive information contents due to incorrect permission assignments.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing proxy due to permission misconfiguration directly enables initial access and data access/modification.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for access to sensitive information, mitigating unauthorized retrieval or alteration due to incorrect permission assignments in IBM Sterling Secure Proxy.
Implements least privilege to restrict permissions to only those necessary, preventing excessive access granted by incorrect assignments in the vulnerable proxy versions.
Requires timely identification, reporting, and correction of the specific flaw causing incorrect permission assignments in IBM Sterling Secure Proxy versions 6.0.0.0 through 6.2.0.0.