cvelistv5 - cve-2024-49784

CVE-2024-49784 (GCVE-0-2024-49784)

Vulnerability from cvelistv5 – Published: 2025-07-08 18:35 – Updated: 2025-08-24 11:21

Summary

IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Assigner

ibm

References

URL

Tags

https://www.ibm.com/support/pages/node/7239145

vendor-advisorypatch

Impacted products

	Vendor	Product	Version
	IBM	OpenPages with Watson	Affected: 8.3 Affected: 9.0 cpe:2.3:a:ibm:openpages_with_watson:9.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49784",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-08T18:57:28.971734Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-08T18:57:40.527Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:openpages_with_watson:9.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "OpenPages with Watson",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "8.3"
            },
            {
              "status": "affected",
              "version": "9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM OpenPages with Watson 8.3 and 9.0 \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecould provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data.\u003c/span\u003e"
            }
          ],
          "value": "IBM OpenPages with Watson 8.3 and 9.0 \n\ncould provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-327",
              "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-24T11:21:07.665Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7239145"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "For IBM OpenPages 9.0 - Apply 9.0 FixPack 3 (9.0.0.3) or later\u003cbr\u003eDownload URL for 9.0.0.3 -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3\"\u003ehttps://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3\u003c/a\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3\"\u003e\u003cbr\u003e\u003cbr\u003e\u003c/a\u003eFor IBM OpenPages 8.3 - Apply 8.3 FixPack 3 (8.3.0.3) Then Apply 8.3.03 Interim Fix 1 (8.3.0.3.1)\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3\"\u003e\u003cbr\u003e\u003cbr\u003e\u003c/a\u003eDownload URL for 8.3.0.3 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/openpages-watson-83-fix-pack-3\"\u003ehttps://www.ibm.com/support/pages/openpages-watson-83-fix-pack-3\u003c/a\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3\"\u003e\u003cbr\u003e\u003c/a\u003eDownload URL for 8.3.0.3.1 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/ibm-openpages-8303-interim-fix-1\"\u003ehttps://www.ibm.com/support/pages/ibm-openpages-8303-interim-fix-1\u003c/a\u003e\u003cbr\u003e"
            }
          ],
          "value": "For IBM OpenPages 9.0 - Apply 9.0 FixPack 3 (9.0.0.3) or later\nDownload URL for 9.0.0.3 -\u00a0 https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3  https://www.ibm.com/support/pages/openpages-watson-83-fix-pack-3  https://www.ibm.com/support/pages/ibm-openpages-8303-interim-fix-1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM OpenPages with Watson information disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-49784",
    "datePublished": "2025-07-08T18:35:23.609Z",
    "dateReserved": "2024-10-20T13:40:05.754Z",
    "dateUpdated": "2025-08-24T11:21:07.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49784\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2025-07-08T19:15:39.170\",\"lastModified\":\"2025-07-14T17:59:28.077\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM OpenPages with Watson 8.3 and 9.0 \\n\\ncould provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data.\"},{\"lang\":\"es\",\"value\":\"IBM OpenPages con Watson 8.3 y 9.0 podr\u00eda ofrecer una seguridad inferior a la esperada en el almacenamiento de datos cifrados con cifrado AES y modo CBC. Si un atacante remoto autenticado con acceso a la base de datos o un atacante local con acceso a los archivos del servidor pudiera extraer los valores de los datos cifrados, podr\u00eda aprovechar este algoritmo m\u00e1s d\u00e9bil para usar m\u00e9todos criptogr\u00e1ficos adicionales y, posiblemente, extraer los datos cifrados.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-327\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:openpages_with_watson:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.3\",\"versionEndExcluding\":\"8.3.0.3.1\",\"matchCriteriaId\":\"4F259B3A-B463-4D3E-9C1E-69C83031B998\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:openpages_with_watson:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0\",\"versionEndExcluding\":\"9.0.0.5\",\"matchCriteriaId\":\"C36C16B7-9740-4060-BCF4-3270CE3176B1\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7239145\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49784\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-08T18:57:28.971734Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-08T18:57:31.965Z\"}}], \"cna\": {\"title\": \"IBM OpenPages with Watson information disclosure\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:openpages_with_watson:9.0:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"OpenPages with Watson\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.3\"}, {\"status\": \"affected\", \"version\": \"9.0\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"For IBM OpenPages 9.0 - Apply 9.0 FixPack 3 (9.0.0.3) or later\\nDownload URL for 9.0.0.3 -\\u00a0 https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3  https://www.ibm.com/support/pages/openpages-watson-83-fix-pack-3  https://www.ibm.com/support/pages/ibm-openpages-8303-interim-fix-1\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"For IBM OpenPages 9.0 - Apply 9.0 FixPack 3 (9.0.0.3) or later\u003cbr\u003eDownload URL for 9.0.0.3 -\u0026nbsp;\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3\\\"\u003ehttps://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3\u003c/a\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3\\\"\u003e\u003cbr\u003e\u003cbr\u003e\u003c/a\u003eFor IBM OpenPages 8.3 - Apply 8.3 FixPack 3 (8.3.0.3) Then Apply 8.3.03 Interim Fix 1 (8.3.0.3.1)\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3\\\"\u003e\u003cbr\u003e\u003cbr\u003e\u003c/a\u003eDownload URL for 8.3.0.3 \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.ibm.com/support/pages/openpages-watson-83-fix-pack-3\\\"\u003ehttps://www.ibm.com/support/pages/openpages-watson-83-fix-pack-3\u003c/a\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.ibm.com/support/pages/ibm-openpages-90-fix-pack-3\\\"\u003e\u003cbr\u003e\u003c/a\u003eDownload URL for 8.3.0.3.1 \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.ibm.com/support/pages/ibm-openpages-8303-interim-fix-1\\\"\u003ehttps://www.ibm.com/support/pages/ibm-openpages-8303-interim-fix-1\u003c/a\u003e\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7239145\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM OpenPages with Watson 8.3 and 9.0 \\n\\ncould provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"IBM OpenPages with Watson 8.3 and 9.0 \\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ecould provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data.\u003c/span\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-327\", \"description\": \"CWE-327 Use of a Broken or Risky Cryptographic Algorithm\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2025-08-24T11:21:07.665Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49784\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-24T11:21:07.665Z\", \"dateReserved\": \"2024-10-20T13:40:05.754Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2025-07-08T18:35:23.609Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-49784

Vulnerability from fkie_nvd - Published: 2025-07-08 19:15 - Updated: 2025-07-14 17:59

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7239145	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	openpages_with_watson	*
ibm	openpages_with_watson	*
linux	linux_kernel	-
microsoft	windows	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:openpages_with_watson:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F259B3A-B463-4D3E-9C1E-69C83031B998",
              "versionEndExcluding": "8.3.0.3.1",
              "versionStartIncluding": "8.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:openpages_with_watson:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C36C16B7-9740-4060-BCF4-3270CE3176B1",
              "versionEndExcluding": "9.0.0.5",
              "versionStartIncluding": "9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM OpenPages with Watson 8.3 and 9.0 \n\ncould provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data."
    },
    {
      "lang": "es",
      "value": "IBM OpenPages con Watson 8.3 y 9.0 podr\u00eda ofrecer una seguridad inferior a la esperada en el almacenamiento de datos cifrados con cifrado AES y modo CBC. Si un atacante remoto autenticado con acceso a la base de datos o un atacante local con acceso a los archivos del servidor pudiera extraer los valores de los datos cifrados, podr\u00eda aprovechar este algoritmo m\u00e1s d\u00e9bil para usar m\u00e9todos criptogr\u00e1ficos adicionales y, posiblemente, extraer los datos cifrados."
    }
  ],
  "id": "CVE-2024-49784",
  "lastModified": "2025-07-14T17:59:28.077",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-07-08T19:15:39.170",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7239145"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Secondary"
    }
  ]
}

GHSA-P8R8-86RR-6MRF

Vulnerability from github – Published: 2025-07-08 21:30 – Updated: 2025-07-08 21:30

Details

IBM OpenPages with Watson 8.3 and 9.0

could provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data.

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-49784"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-327"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-08T19:15:39Z",
    "severity": "MODERATE"
  },
  "details": "IBM OpenPages with Watson 8.3 and 9.0 \n\ncould provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data.",
  "id": "GHSA-p8r8-86rr-6mrf",
  "modified": "2025-07-08T21:30:27Z",
  "published": "2025-07-08T21:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49784"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7239145"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CNVD-2025-23714

Vulnerability from cnvd - Published: 2025-10-15

Title

IBM OpenPages with Watson加密问题漏洞

Description

IBM OpenPages with Watson是美国国际商业机器（IBM）公司的一个AI驱动的金融风险分析解决方案。该平台基于AI技术来预测风险系数，将风险数据通过集成、自动识别、测量、监控、分析、管理等步骤将金融活动中的风险最小化。 IBM OpenPages with Watson存在加密问题漏洞，该漏洞源于AES加密和CBC模式存储安全性不足，攻击者利用该漏洞导致数据泄露。

Severity

中

Patch Name

IBM OpenPages with Watson加密问题漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/7239145

Reference

https://nvd.nist.gov/vuln/detail/CVE-2024-49784

Impacted products

Name
['IBM OpenPages with Watson 9.0', 'IBM OpenPages with Watson 8.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-49784",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-49784"
    }
  },
  "description": "IBM OpenPages with Watson\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u4e2aAI\u9a71\u52a8\u7684\u91d1\u878d\u98ce\u9669\u5206\u6790\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u5e73\u53f0\u57fa\u4e8eAI\u6280\u672f\u6765\u9884\u6d4b\u98ce\u9669\u7cfb\u6570\uff0c\u5c06\u98ce\u9669\u6570\u636e\u901a\u8fc7\u96c6\u6210\u3001\u81ea\u52a8\u8bc6\u522b\u3001\u6d4b\u91cf\u3001\u76d1\u63a7\u3001\u5206\u6790\u3001\u7ba1\u7406\u7b49\u6b65\u9aa4\u5c06\u91d1\u878d\u6d3b\u52a8\u4e2d\u7684\u98ce\u9669\u6700\u5c0f\u5316\u3002\n\nIBM OpenPages with Watson\u5b58\u5728\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eAES\u52a0\u5bc6\u548cCBC\u6a21\u5f0f\u5b58\u50a8\u5b89\u5168\u6027\u4e0d\u8db3\uff0c\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u6570\u636e\u6cc4\u9732\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/7239145",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-23714",
  "openTime": "2025-10-15",
  "patchDescription": "IBM OpenPages with Watson\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u4e2aAI\u9a71\u52a8\u7684\u91d1\u878d\u98ce\u9669\u5206\u6790\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u5e73\u53f0\u57fa\u4e8eAI\u6280\u672f\u6765\u9884\u6d4b\u98ce\u9669\u7cfb\u6570\uff0c\u5c06\u98ce\u9669\u6570\u636e\u901a\u8fc7\u96c6\u6210\u3001\u81ea\u52a8\u8bc6\u522b\u3001\u6d4b\u91cf\u3001\u76d1\u63a7\u3001\u5206\u6790\u3001\u7ba1\u7406\u7b49\u6b65\u9aa4\u5c06\u91d1\u878d\u6d3b\u52a8\u4e2d\u7684\u98ce\u9669\u6700\u5c0f\u5316\u3002\r\n\r\nIBM OpenPages with Watson\u5b58\u5728\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eAES\u52a0\u5bc6\u548cCBC\u6a21\u5f0f\u5b58\u50a8\u5b89\u5168\u6027\u4e0d\u8db3\uff0c\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u6570\u636e\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM OpenPages with Watson\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM OpenPages with Watson 9.0",
      "IBM OpenPages with Watson 8.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-49784",
  "serverity": "\u4e2d",
  "submitTime": "2025-07-21",
  "title": "IBM OpenPages with Watson\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-49784 (GCVE-0-2024-49784)

FKIE_CVE-2024-49784

GHSA-P8R8-86RR-6MRF

CNVD-2025-23714

Tags

Sightings

Nomenclature