CVE-2024-22347
Published: 20 January 2025
Description
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Security Summary
CVE-2024-22347 is a cryptographic weakness (CWE-327) in IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity versions 4.0.0 through 4.0.25, where weaker than expected cryptographic algorithms are used. This flaw could enable an attacker to decrypt highly sensitive information. The vulnerability carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating medium severity with high confidentiality impact but no integrity or availability effects.
A remote attacker with network access could potentially exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. Successful exploitation would allow decryption of highly sensitive data stored or transmitted by the affected software, compromising confidentiality.
IBM has published a security bulletin at https://www.ibm.com/support/pages/node/7172750 providing details on the issue and recommended mitigation steps.
Details
- CWE(s)