CVE-2024-52367
Published: 07 January 2025
Summary
CVE-2024-52367 is a medium-severity Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) vulnerability in Ibm Concert. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique System Information Discovery (T1082); ranked at the 34.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-14 (Public Access Protections) and SI-11 (Error Handling).
Deeper analysis
CVE-2024-52367 affects IBM Concert Software versions 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3, where the software could disclose sensitive system information to an unauthorized actor. This vulnerability, mapped to CWE-497 (with NVD-CWE-noinfo), carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting medium severity primarily due to low-impact confidentiality loss.
A remote attacker without privileges or user interaction can exploit this over the network with low attack complexity. Exploitation results in access to sensitive system information, which could facilitate further attacks against the system.
The IBM security advisory provides details on remediation; see https://www.ibm.com/support/pages/node/7180303.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-46235
Vulnerability details
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could disclose sensitive system information to an unauthorized actor that could be used in further attacks against the system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct info disclosure enables remote System Information Discovery without auth.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Protects sensitive information associated with public-facing systems from unauthorized remote access, directly mitigating the network-accessible disclosure to unauthenticated actors.
Filters information prior to output to non-privileged users, preventing the unauthorized disclosure of sensitive system information.
Ensures error messages reveal only non-sensitive information, addressing common vectors for sensitive system data exposure to attackers.