CVE-2024-22348

MEDIUM

IBM DevOps Velocity 5.0.0, IBM UrbanCode Velocity 4.0.0-4.0.25 - SSRF

Title source: llm

Description

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.

References (1)

[Vendor Advisory] https://www.ibm.com/support/pages/node/7172750

Scores

CVSS v3 5.3

EPSS 0.0004

EPSS Percentile 13.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-942

Status published

Products (2)

ibm/devops_velocity 5.0.0

ibm/urbancode_velocity 4.0.0 - 4.0.15

Published Jan 20, 2025

Tracked Since Feb 18, 2026