CVE-2024-49808

MEDIUM

IBM Sterling Connect:Direct Web Services <6.3.0 - Auth Bypass

Title source: llm

Description

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory patch

https://www.ibm.com/support/pages/node/7231180

Scores

CVSS v3 6.3

EPSS 0.0013

EPSS Percentile 32.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-863

Status published

Products (1)

ibm/sterling_connect_direct_web_services 6.1.0 - 6.1.0.28

Published Apr 18, 2025

Tracked Since Feb 18, 2026