CVE-2024-41763
Published: 04 January 2025
Summary
CVE-2024-41763 is a medium-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Ibm Engineering Lifecycle Optimization Publishing. Its CVSS base score is 5.9 (Medium).
Operationally, ranked at the 14.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SC-28 (Protection of Information at Rest).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires implementation of cryptographic protections using compliant modules, protocols, and standards, preventing use of weaker-than-expected algorithms as in this CVE.
Mandates cryptographic mechanisms to protect confidentiality of sensitive information at rest, directly mitigating decryption risks from weak algorithms protecting such data.
Protects confidentiality of transmitted sensitive information using cryptographic mechanisms, addressing network-based decryption attacks enabled by weak algorithms.
NVD Description
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Deeper analysisAI
CVE-2024-41763 is a cryptographic weakness in IBM Engineering Lifecycle Optimization - Publishing versions 7.0.2 and 7.0.3, where weaker than expected cryptographic algorithms are used. This flaw, published on 2025-01-04, is categorized under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating medium severity primarily due to high confidentiality impact.
An unauthenticated attacker (PR:N) with network access (AV:N) could potentially exploit this vulnerability to decrypt highly sensitive information. The attack requires high complexity (AC:H) and no user interaction (UI:N), with no impact on integrity or availability, but successful exploitation would grant high-level access to confidential data (C:H) in an unchanged scope (S:U).
IBM provides details on the vulnerability, including mitigation and patch information, in their security advisory at https://www.ibm.com/support/pages/node/7180204.
Details
- CWE(s)