CVE-2024-22347
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 use weaker than expected cryptographic algorithms, potentially allowing an attacker to decrypt highly sensitive information.
Risk Assessment
An attacker could decrypt sensitive data such as passwords or API keys, leading to confidentiality breaches and enabling further attacks.
Recommendation
Update the software to the latest version and configure stronger encryption algorithms as recommended by the vendor.
Other vulnerabilities in IBM DevOps Velocity
See all- CVE-2024-22349Medium
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 store web pages locally, allowing another system user to read them.
- CVE-2024-22348Medium
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 do not restrict domains in CORS, potentially allowing an attacker to perform privileged actions and retrieve sensitive information.
Original NVD description (English source)
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS