CVE-2024-41787
Published: 10 January 2025
Summary
CVE-2024-41787 is a critical-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Ibm Doors Next. Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 6.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the race condition vulnerability by applying vendor patches as specified in the IBM advisory.
Implements a reference monitor that ensures complete mediation without time-of-check-to-time-of-use race conditions allowing security bypass.
Validates specially crafted requests to mitigate exploitation attempts targeting the race condition.
NVD Description
IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted request, an attacker could exploit this vulnerability to remotely execute code.
Deeper analysisAI
IBM Engineering Requirements Management DOORS Next versions 7.0.2 and 7.0.3 are affected by CVE-2024-41787, a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) stemming from a race condition (CWE-367). This flaw enables a remote attacker to bypass security restrictions by sending a specially crafted request, potentially leading to remote code execution.
The vulnerability can be exploited by any unauthenticated remote attacker over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access, allowing the attacker to achieve full confidentiality, integrity, and availability compromise on the targeted system.
For mitigation details, refer to the official IBM advisory at https://www.ibm.com/support/pages/node/7180636, which outlines available patches and remediation steps.
Details
- CWE(s)