CVE-2024-41767
Published: 04 January 2025
Summary
CVE-2024-41767 is a high-severity SQL Injection (CWE-89) vulnerability in Ibm Engineering Lifecycle Optimization Publishing. Its CVSS base score is 7.3 (High).
Operationally, ranked at the 29.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation of all user inputs before they are processed in database queries.
Requires timely remediation of known flaws like this SQL injection vulnerability through patching as provided in the IBM advisory.
Boundary protection with web application firewalls can inspect traffic and block specially crafted SQL injection payloads.
NVD Description
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Deeper analysisAI
CVE-2024-41767 is a SQL injection vulnerability (CWE-89) in IBM Engineering Lifecycle Optimization - Publishing versions 7.0.2 and 7.0.3. Published on 2025-01-04, it carries a CVSS v3.1 base score of 7.3 (High: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating network accessibility with low attack complexity and no prerequisites.
A remote attacker could exploit this by sending specially crafted SQL statements to the application, potentially viewing, adding, modifying, or deleting information in the back-end database. No user privileges or interaction are needed, enabling unauthorized low-level impacts on confidentiality, integrity, and availability without scope changes.
The IBM security advisory at https://www.ibm.com/support/pages/node/7180199 provides details on patches and mitigation steps.
Details
- CWE(s)