cvelistv5 - CVE-2024-52891

CVE-2024-52891 (GCVE-0-2024-52891)

Vulnerability from cvelistv5 – Published: 2025-01-07 11:58 – Updated: 2025-01-07 14:47

Summary

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-117 - Improper Output Neutralization for Logs

Assigner

ibm

References

URL

Tags

https://www.ibm.com/support/pages/node/7180303

Impacted products

	Vendor	Product	Version
	IBM	Concert Software	Affected: 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, 1.0.3 cpe:2.3:a:ibm:concert:1.0.0:::::::* cpe:2.3:a:ibm:concert:1.0.1:::::::* cpe:2.3:a:ibm:concert:1.0.2:::::::* cpe:2.3:a:ibm:concert:1.0.2.1:::::::* cpe:2.3:a:ibm:concert:1.0.3:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-52891",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-07T14:47:31.775559Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-07T14:47:44.238Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:concert:1.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:concert:1.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:concert:1.0.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:concert:1.0.3:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Concert Software",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0, 1.0.1, 1.0.2, 1.0.2.1, 1.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecould allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.\u003c/span\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 \n\ncould allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117 Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-07T11:58:13.671Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "url": "https://www.ibm.com/support/pages/node/7180303"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Concert Software log manipulation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-52891",
    "datePublished": "2025-01-07T11:58:13.671Z",
    "dateReserved": "2024-11-17T14:25:44.933Z",
    "dateUpdated": "2025-01-07T14:47:44.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 \\n\\ncould allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.\"}, {\"lang\": \"es\", \"value\": \"IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1 y 1.0.3 podr\\u00eda permitir que un usuario autenticado inyecte informaci\\u00f3n maliciosa u obtenga informaci\\u00f3n de archivos de registro debido a una neutralizaci\\u00f3n incorrecta de los registros.\"}]",
      "id": "CVE-2024-52891",
      "lastModified": "2025-01-07T12:15:25.010",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@us.ibm.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.5}]}",
      "published": "2025-01-07T12:15:25.010",
      "references": "[{\"url\": \"https://www.ibm.com/support/pages/node/7180303\", \"source\": \"psirt@us.ibm.com\"}]",
      "sourceIdentifier": "psirt@us.ibm.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"psirt@us.ibm.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-117\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-52891\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2025-01-07T12:15:25.010\",\"lastModified\":\"2025-07-18T13:39:22.407\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 \\n\\ncould allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.\"},{\"lang\":\"es\",\"value\":\"IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1 y 1.0.3 podr\u00eda permitir que un usuario autenticado inyecte informaci\u00f3n maliciosa u obtenga informaci\u00f3n de archivos de registro debido a una neutralizaci\u00f3n incorrecta de los registros.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-117\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-116\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"557B94A2-6EC2-4F29-95AE-306B55C7C11D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:concert:1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB02F586-96A0-4FAC-91CD-2B48EF222945\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:concert:1.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"35C3FEC7-5494-4120-B80F-87E19F9874F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:concert:1.0.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BFF310F-2638-44A4-927B-9E799D9AC172\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:concert:1.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41C89595-90AB-41CD-AA0A-895E264CD474\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7180303\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-52891\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-07T14:47:31.775559Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-07T14:47:38.535Z\"}}], \"cna\": {\"title\": \"IBM Concert Software log manipulation\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:concert:1.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:concert:1.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:concert:1.0.2.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:concert:1.0.3:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"Concert Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0, 1.0.1, 1.0.2, 1.0.2.1, 1.0.3\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7180303\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 \\n\\ncould allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eIBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 \\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ecould allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.\u003c/span\u003e\\n\\n\u003c/span\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-117\", \"description\": \"CWE-117 Improper Output Neutralization for Logs\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2025-01-07T11:58:13.671Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-52891\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-07T14:47:44.238Z\", \"dateReserved\": \"2024-11-17T14:25:44.933Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2025-01-07T11:58:13.671Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CNVD-2025-02547

Vulnerability from cnvd - Published: 2025-02-06

Title

IBM Concert输入验证错误漏洞（CNVD-2025-02547）

Description

IBM Concert是美国国际商业机器（IBM）公司的一种新工具。使用生成式AI来帮助管理复杂的云原生应用程序。 IBM Concert 1.0.0版本、1.0.1版本、1.0.2版本、1.0.2.1版本和1.0.3版本存在输入验证错误漏洞，该漏洞源于不正确的日志中和处理，攻击者可利用该漏洞注入恶意信息或从日志文件中获取信息。

Severity

中

Patch Name

IBM Concert输入验证错误漏洞（CNVD-2025-02547）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/7180303

Reference

https://nvd.nist.gov/vuln/detail/CVE-2024-52891

Impacted products

Name
['IBM IBM Concert 1.0.0', 'IBM IBM Concert 1.0.1', 'IBM IBM Concert 1.0.2', 'IBM IBM Concert 1.0.2.1', 'IBM IBM Concert 1.0.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-52891",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-52891"
    }
  },
  "description": "IBM Concert\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u79cd\u65b0\u5de5\u5177\u3002\u4f7f\u7528\u751f\u6210\u5f0fAI\u6765\u5e2e\u52a9\u7ba1\u7406\u590d\u6742\u7684\u4e91\u539f\u751f\u5e94\u7528\u7a0b\u5e8f\u3002\n\nIBM Concert 1.0.0\u7248\u672c\u30011.0.1\u7248\u672c\u30011.0.2\u7248\u672c\u30011.0.2.1\u7248\u672c\u548c1.0.3\u7248\u672c\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4e0d\u6b63\u786e\u7684\u65e5\u5fd7\u4e2d\u548c\u5904\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u6076\u610f\u4fe1\u606f\u6216\u4ece\u65e5\u5fd7\u6587\u4ef6\u4e2d\u83b7\u53d6\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/7180303",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-02547",
  "openTime": "2025-02-06",
  "patchDescription": "IBM Concert\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u79cd\u65b0\u5de5\u5177\u3002\u4f7f\u7528\u751f\u6210\u5f0fAI\u6765\u5e2e\u52a9\u7ba1\u7406\u590d\u6742\u7684\u4e91\u539f\u751f\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nIBM Concert 1.0.0\u7248\u672c\u30011.0.1\u7248\u672c\u30011.0.2\u7248\u672c\u30011.0.2.1\u7248\u672c\u548c1.0.3\u7248\u672c\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4e0d\u6b63\u786e\u7684\u65e5\u5fd7\u4e2d\u548c\u5904\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u6076\u610f\u4fe1\u606f\u6216\u4ece\u65e5\u5fd7\u6587\u4ef6\u4e2d\u83b7\u53d6\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Concert\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2025-02547\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM IBM Concert 1.0.0",
      "IBM IBM Concert 1.0.1",
      "IBM IBM Concert 1.0.2",
      "IBM IBM Concert 1.0.2.1",
      "IBM IBM Concert 1.0.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-52891",
  "serverity": "\u4e2d",
  "submitTime": "2025-01-16",
  "title": "IBM Concert\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2025-02547\uff09"
}

GHSA-8H38-QX4M-2F5R

Vulnerability from github – Published: 2025-01-07 12:31 – Updated: 2025-01-07 12:31

Details

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3

could allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.

Severity ?

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-52891"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-117"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-07T12:15:25Z",
    "severity": "MODERATE"
  },
  "details": "IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 \n\ncould allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.",
  "id": "GHSA-8h38-qx4m-2f5r",
  "modified": "2025-01-07T12:31:02Z",
  "published": "2025-01-07T12:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52891"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7180303"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2024-52891

Vulnerability from fkie_nvd - Published: 2025-01-07 12:15 - Updated: 2025-07-18 13:39

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7180303	Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	concert	1.0.0
ibm	concert	1.0.1
ibm	concert	1.0.2
ibm	concert	1.0.2.1
ibm	concert	1.0.3

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "557B94A2-6EC2-4F29-95AE-306B55C7C11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:concert:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB02F586-96A0-4FAC-91CD-2B48EF222945",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:concert:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "35C3FEC7-5494-4120-B80F-87E19F9874F4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:concert:1.0.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BFF310F-2638-44A4-927B-9E799D9AC172",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:concert:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "41C89595-90AB-41CD-AA0A-895E264CD474",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 \n\ncould allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization."
    },
    {
      "lang": "es",
      "value": "IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1 y 1.0.3 podr\u00eda permitir que un usuario autenticado inyecte informaci\u00f3n maliciosa u obtenga informaci\u00f3n de archivos de registro debido a una neutralizaci\u00f3n incorrecta de los registros."
    }
  ],
  "id": "CVE-2024-52891",
  "lastModified": "2025-07-18T13:39:22.407",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-01-07T12:15:25.010",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7180303"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-117"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-52891 (GCVE-0-2024-52891)

CNVD-2025-02547

GHSA-8H38-QX4M-2F5R

FKIE_CVE-2024-52891

Tags

Sightings

Nomenclature