Cyber Posture

CVE-2024-51459

High

Published: 19 March 2025

Published
19 March 2025
Modified
07 July 2025
KEV Added
—
Patch
—
CVSS Score 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 6.8th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

IBM InfoSphere Information Server 11.7 is affected by CVE-2024-51459, a vulnerability stemming from improper handling of permissions (CWE-280). This flaw enables a local user to execute privileged commands. The issue carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.

A local attacker requires only local access to the system, with no privileges (PR:N), low attack complexity, and no user interaction needed. Successful exploitation allows the execution of privileged commands, granting high-level control over the affected system and potentially leading to full compromise.

IBM has issued an advisory at https://www.ibm.com/support/pages/node/7185056, which provides details on the vulnerability and recommended mitigation steps, including applying available patches.

Details

CWE(s)
CWE-280

Affected Products

ibm
infosphere information server
11.7 — 11.7.1.136

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Local privilege escalation via improper permissions handling (CWE-280) enabling execution of privileged commands with no initial privileges.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References