CVE-2024-49783
Ibm Openpages With Watson 8.3 – 8.3.0.3.1
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2024-49783 is a medium-severity Generation of Predictable IV with CBC Mode (CWE-329) vulnerability in Ibm Openpages With Watson. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Weaken Encryption (T1600); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-8 (Security and Privacy Engineering Principles) and SC-13 (Cryptographic Protection) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54764
Vulnerability Data
IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the…
more
encrypted data, they could exploit this vulnerability to use additional cryptographic methods to possibly extract the encrypted data.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V11.6.1
Mitigating Controls (NIST 800-53 r5) AI
Engineering principles applied during design and implementation can mandate cryptographically secure IV generation.
Specifying and enforcing approved cryptographic algorithms and implementations directly requires non-predictable IVs for CBC.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce correct cryptographic implementation such as random IV generation for CBC.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates proper cryptographic controls including IV generation, directly preventing predictable-IV CBC weaknesses.
Security testing in development can detect predictable IV usage before deployment.
Secure SDLC processes catch cryptographic flaws like bad IVs during design and review phases.
Secure architecture principles guide selection of strong cryptographic primitives and IV handling.
Requires secure coding practices that eliminate predictable IV usage in CBC implementations.