Skip to content
OpenAdvisories
Critical VA-24-254-01 3 CVEs

IBM webMethods Integration Multiple Vulnerabilities

Published Sep 10, 2024 · Updated Sep 10, 2024 · Revision 2

Vendor: IBM Product: webMethods Integration

Summary

IBM webMethods Integration contains multiple vulnerabilities that could allow an authenticated attacker to escalate privileges within webMethods, execute arbitrary operating system commands, or read arbitrary files.

Vulnerabilities 3

  • Critical 9.9
    CVE-2024-45076

    IBM webMethods Integration code execution

    IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating system.

    IBM webMethods Integration
  • High 8.8
    CVE-2024-45075

    IBM webMethods Integration privilege escalation

    IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administrator due to missing authentication.

    IBM webMethods Integration
  • Medium 6.5
    CVE-2024-45074

    IBM webMethods Integration directory traversal

    IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

    IBM webMethods Integration

Revision history

  1. #1.0.1

    Fix acknowledgments, section headings

  2. #1.0.0

    Initial publication