CVE-2024-49338

Ibm App Connect Enterprise 12.0.1.0 – 12.0.12.8

Published

18 January 2025

Modified

13 August 2025

Patch / advisory

View advisory

CVSS Score v3.1 4.4

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0037 30th percentile

Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2024-49338 is a medium-severity Improper Management of Sensitive Trace Data (CWE-1323) vulnerability in Ibm App Connect Enterprise. Its CVSS base score is 4.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-43683

Vulnerability Data

IBM App Connect Enterprise 12.0.1.0 through 12.0.7.0and 13.0.1.0 under certain configurations could allow a privileged user to obtain JMS credentials.

CWE(s): CWE-1323

Related Threats

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1119 Automated Collection Collection

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

attack.mitre.org →

T1552 Unsecured Credentials Credential Access

Adversaries may search compromised systems to find and obtain insecurely stored credentials.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-1348Same product: Ibm Aix

CVE-2023-43035Same product: Ibm Aix

CVE-2024-7577Same product: Ibm Aix

CVE-2023-24964Same product: Ibm Aix

CVE-2023-22878Same product: Ibm Aix

CVE-2025-36258Same product: Ibm Aix

CVE-2024-43186Same product: Ibm Aix

CVE-2023-25926Same product: Ibm Aix

CVE-2023-47704Same product: Ibm Aix

CVE-2023-42019Same product: Ibm Aix

Affected Assets

ibm

app connect enterprise

13.0.1.0 · 12.0.1.0 — 12.0.12.8

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Enforces access authorizations so sensitive trace data cannot be stored or accessed in unprotected locations.

AC-4 Information Flow Enforcement good match

Enforces information flow policies that block trace data from reaching untrusted agents or destinations.

SC-28 Protection of Information at Rest good match

Requires protection of information at rest, directly stopping storage of trace data in unprotected locations.

SC-8 Transmission Confidentiality and Integrity good match

Requires confidentiality and integrity protection for all transmitted trace data, directly stopping exposure in transit.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 mostly match

prevents

Protecting data-at-rest directly prevents storage of trace data in unprotected locations.

PR.DS-02 mostly match

prevents

Protecting data-in-transit directly prevents transport of trace data to untrusted agents.

PR.DS-10 partial match

prevents

Protecting data-in-use can limit exposure during trace collection or processing.

PR.PS-04 partial match

prevents

Requiring protected log generation and handling indirectly covers sensitive trace data as a form of logging.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.12 Data leakage prevention mostly match

prevents

DLP mechanisms can detect and block exfiltration of trace data.

A.8.3 Information access restriction mostly match

prevents

Technical access restrictions directly prevent unauthorized access to trace storage.

A.5.12 Classification of information partial match

prevents

Classification identifies trace data as sensitive, guiding its protection.

A.5.14 Information transfer partial match

prevents

Rules for secure transfer reduce exposure when trace data leaves the SoC.