CVE-2024-43196
Ibm Openpages With Watson 8.3 – 8.3.0.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NSummary
CVE-2024-43196 is a medium-severity Improper Following of a Certificate's Chain of Trust (CWE-296) vulnerability in Ibm Openpages With Watson. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Subvert Trust Controls (T1553); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-17 (Public Key Infrastructure Certificates) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4627
Vulnerability Data
IBM OpenPages with Watson 8.3 and 9.0 application could allow an authenticated user to manipulate data in the Questionnaires application allowing the user to spoof other users' responses.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 12 hardening rules · 5 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
SC-17 requires proper issuance and management of PKI certificates, which structurally enforces correct chain-of-trust validation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper service/hardware authentication requires correct certificate chain validation to a trusted root.
Pre-acquisition authenticity checks may surface certificate issues but do not address runtime chain-following logic.
Verifying identity assertions includes ensuring certificate chains are followed correctly.
Protecting data-in-transit commonly depends on TLS certificate chain validation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates proper use of cryptography including certificate validation and trusted roots.
Security testing can detect missing or incorrect certificate chain validation.
Secure coding standards address correct certificate chain validation.
Requires secure authentication mechanisms that rely on valid certificate chains.
Network security controls often enforce TLS certificate validation.
Secure network services depend on correct certificate chain validation.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248531 OL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. prevents CWE-296
Oracle Linux 9 (1 rule)
- V-271604 OL 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. prevents CWE-296
RHEL 8 (1 rule)
- V-230229 RHEL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. prevents CWE-296
RHEL 9 (1 rule)
- V-258131 RHEL 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. prevents CWE-296