Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2024-41763 is a medium-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Ibm Engineering Lifecycle Optimization Publishing. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-41763 is a cryptographic weakness in IBM Engineering Lifecycle Optimization - Publishing versions 7.0.2 and 7.0.3, where weaker than expected cryptographic algorithms are used. This flaw, published on 2025-01-04, is categorized under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating medium severity primarily due to high confidentiality impact.
An unauthenticated attacker (PR:N) with network access (AV:N) could potentially exploit this vulnerability to decrypt highly sensitive information. The attack requires high complexity (AC:H) and no user interaction (UI:N), with no impact on integrity or availability, but successful exploitation would grant high-level access to confidential data (C:H) in an unchanged scope (S:U).
IBM provides details on the vulnerability, including mitigation and patch information, in their security advisory at https://www.ibm.com/support/pages/node/7180204.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38901
Vulnerability Data
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated network exploitation of weak crypto in public-facing IBM app directly maps to T1190 for initial access and data decryption.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires implementation of cryptographic protections using compliant modules, protocols, and standards, preventing use of weaker-than-expected algorithms as in this CVE.
Mandates cryptographic mechanisms to protect confidentiality of sensitive information at rest, directly mitigating decryption risks from weak algorithms protecting such data.
Protects confidentiality of transmitted sensitive information using cryptographic mechanisms, addressing network-based decryption attacks enabled by weak algorithms.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.DS-01 promotes encryption for data-at-rest but never requires strong algorithms, leaving CWE-327 fully possible; the weakness is also far broader than data-at-rest so one narrow control removes none of its total risk.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandating approved algorithms, cipher strength and usage standards directly stops the selection of broken or weak cryptographic primitives that attackers can exploit.
The explicit call-out of cryptography-related legal constraints (import/export, key escrow, digital-signature validity) reduces the likelihood that an organization will adopt broken or non-compliant cryptographic algorithms that violate those rules.
Access to current specialist guidance and early vulnerability alerts enables timely replacement of broken or risky cryptographic algorithms with stronger alternatives.