CVE-2024-22349
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 store web pages locally, allowing another system user to read them.
Risk Assessment
A local user can access sensitive data stored in another user's browser cache, leading to information disclosure.
Recommendation
Update IBM DevOps Velocity and IBM UrbanCode Velocity to the latest patched version.
Other vulnerabilities in IBM DevOps Velocity
See all- CVE-2024-22348Medium
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 do not restrict domains in CORS, potentially allowing an attacker to perform privileged actions and retrieve sensitive information.
- CVE-2024-22347Medium
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 use weaker than expected cryptographic algorithms, potentially allowing an attacker to decrypt highly sensitive information.
Original NVD description (English source)
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS