CVE-2024-31903
Published: 22 January 2025
Description
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 allow an attacker on the local network to execute arbitrary code on the system, caused by the deserialization of untrusted data.
Security Summary
CVE-2024-31903 is a high-severity vulnerability (CVSS 8.8) in IBM Sterling B2B Integrator Standard Edition, affecting versions 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2. It stems from CWE-502, the deserialization of untrusted data, which enables an attacker on the local network to execute arbitrary code on the system.
An unauthenticated attacker with adjacent network access (AV:A) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N), requiring no privileges (PR:N) and maintaining unchanged scope (S:U). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), allowing full arbitrary code execution on the targeted system.
IBM has published details and mitigation guidance in its security bulletin at https://www.ibm.com/support/pages/node/7172233, published on 2025-01-22. Security practitioners should consult this advisory for patching instructions and workarounds applicable to the affected versions.
Details
- CWE(s)