CVE-2024-31896
Published: 25 March 2025
Description
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
Security Summary
CVE-2024-31896 is a cryptographic weakness (CWE-327: Broken or Risky Cryptographic Algorithm) in IBM SPSS Statistics versions 26.0, 27.0.1, 28.0.1, and 29.0.2. The affected software uses weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Published on 2025-03-25, it carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating medium severity primarily due to high confidentiality impact.
A remote network attacker (AV:N) with no privileges (PR:N) or user interaction (UI:N) required could exploit this vulnerability, though it demands high attack complexity (AC:H). Successful exploitation would result in high confidentiality impact (C:H), enabling the decryption of highly sensitive information stored or transmitted by the affected SPSS Statistics installations, with no integrity or availability disruption.
IBM provides details on the vulnerability, affected versions, and remediation steps in their security advisory at https://www.ibm.com/support/pages/node/7228971.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The cryptographic weakness allows decryption of sensitive information stored or transmitted by the software, directly facilitating data collection from local systems (T1005) and network sniffing (T1040) to obtain that information.