Cyber Resilience

CVE-2024-49355

Medium

Published: 20 February 2025

Published
20 February 2025
Modified
11 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0017 38.5th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-49355 is a medium-severity Improper Output Neutralization for Logs (CWE-117) vulnerability in Ibm Openpages With Watson. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 38.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enabled per the System Tracing feature.

CWE(s)
CWE-117CWE-116

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

ibm
openpages with watson
8.3 — 8.3.0.3 · 9.0 — 9.0.0.5

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-15 Information Output Filtering
addresses: CWE-116 CWE-117

Validating that output matches expected content directly mitigates failures to properly encode or escape data for its destination context.

AU-1 Policy and Procedures
addresses: CWE-117

Policy and procedures require sanitization and neutralization when generating audit logs to avoid injection issues.

References