CVE-2024-49354
Published: 18 January 2025
Summary
CVE-2024-49354 is a medium-severity Exposure of Sensitive Information Due to Incompatible Policies (CWE-213) vulnerability in Ibm Concert. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-49354 is a sensitive information disclosure vulnerability affecting IBM Concert versions 1.0.0, 1.0.1, and 1.0.2. The flaw allows unauthorized access to sensitive data through specially crafted API calls and is classified under CWE-213. It carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating medium severity with network accessibility, low attack complexity, no privileges or user interaction required, unchanged scope, low confidentiality impact, and no integrity or availability impact.
Remote attackers can exploit this vulnerability over the network without authentication by sending maliciously crafted API requests to affected IBM Concert instances. Successful exploitation results in the disclosure of sensitive information, potentially aiding further attacks, though the impact is limited to low confidentiality loss.
IBM has published a security advisory with details on the vulnerability at https://www.ibm.com/support/pages/node/7174120. Security practitioners should consult this bulletin for guidance on available patches and mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43684
Vulnerability details
IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated exploitation of public-facing app API for info disclosure matches T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to information, directly preventing unauthorized disclosure of sensitive data via unauthenticated API calls.
AC-14 identifies and explicitly authorizes specific actions without identification or authentication, mitigating exploitation through specially crafted unauthenticated API requests.
SI-15 filters information prior to output from API responses, preventing the leakage of sensitive data in responses to crafted requests.