CVE-2024-49348

MEDIUM

IBM Cloud Pak for Business Automation 18.0.0-22.0.2 - Incorrect Privilege Assignment via Task Reassignment

Title source: llm
STIX 2.1

Description

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows restricting access to organizational data to valid contexts. The fact that tasks of type comment can be reassigned via API implicitly grants access to user queries in an unexpected context.

References (1)

Core 1
Core References

Scores

CVSS v3 4.3
EPSS 0.0007
EPSS Percentile 21.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-266
Status published
Products (14)
ibm/cloud_pak_for_business_automation 18.0.0
ibm/cloud_pak_for_business_automation 18.0.1
ibm/cloud_pak_for_business_automation 18.0.2
ibm/cloud_pak_for_business_automation 19.0.1
ibm/cloud_pak_for_business_automation 19.0.2
ibm/cloud_pak_for_business_automation 19.0.3
ibm/cloud_pak_for_business_automation 20.0.1
ibm/cloud_pak_for_business_automation 20.0.2
ibm/cloud_pak_for_business_automation 20.0.3
ibm/cloud_pak_for_business_automation 21.0.1
... and 4 more
Published Feb 05, 2025
Tracked Since Feb 18, 2026