CVE-2024-49781
Published: 20 February 2025
Summary
CVE-2024-49781 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Ibm Openpages With Watson. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through vendor patches directly eliminates the XXE vulnerability in IBM OpenPages XML processing.
Information input validation prevents malicious XML payloads from injecting external entities, blocking both disclosure and resource exhaustion.
Secure configuration settings disable external entity resolution in XML parsers, mitigating the core XXE attack vector.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XXE directly enables local file reads (T1005) via external entity processing and is exploited in a public-facing web app (T1190).
NVD Description
IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Deeper analysisAI
IBM OpenPages with Watson versions 8.3 and 9.0 is vulnerable to CVE-2024-49781, an XML external entity (XXE) injection flaw that occurs when processing XML data. This vulnerability, published on 2025-02-20, carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) and is associated with CWE-611. It allows attackers to potentially read sensitive files or manipulate XML parsing in ways that lead to information disclosure or resource exhaustion.
A remote attacker with low privileges (PR:L) can exploit this over the network with low complexity and no user interaction required. Successful exploitation enables the disclosure of sensitive information from the server or consumption of memory resources, resulting in high confidentiality impact (C:H) and low availability impact (A:L), without affecting integrity.
The IBM security advisory at https://www.ibm.com/support/pages/node/7183541 provides details on the vulnerability, including recommended mitigations and patches for affected versions.
Details
- CWE(s)