CVE-2024-49808

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions.

CVSS v3.0 6.5 MEDIUM

6.5^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7231180	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:sterling_connect_direct_web_services::::::::
	cpe:2.3:a:ibm:sterling_connect_direct_web_services::::::::
	cpe:2.3:a:ibm:sterling_connect_direct_web_services::::::::

OR	cpe:2.3:o:ibm:aix:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

18 Jul 2025, 13:44

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~6.3~~	v2 : unknown v3 : 6.5
CPE		cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:o:ibm:aix:-:::::::* cpe:2.3:a:ibm:sterling_connect_direct_web_services::::::::
References	~~() https://www.ibm.com/support/pages/node/7231180 -~~	() https://www.ibm.com/support/pages/node/7231180 - Vendor Advisory
First Time		Linux Microsoft windows Microsoft Ibm sterling Connect Direct Web Services Linux linux Kernel Ibm Ibm aix

18 Apr 2025, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-18 11:15

Updated : 2025-07-18 13:44

NVD link : CVE-2024-49808

Mitre link : CVE-2024-49808

JSON object : View

Products Affected

linux

linux_kernel

ibm

sterling_connect_direct_web_services
aix

microsoft

windows

CWE

CWE-863

Incorrect Authorization

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.ibm.com/support/pages/node/7231180", "name": "https://www.ibm.com/support/pages/node/7231180", "tags": ["Vendor Advisory"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-863"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2024-49808", "ASSIGNER": "psirt@us.ibm.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}}, "publishedDate": "2025-04-18T11:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:sterling_connect_direct_web_services:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "6.1.0.28", "versionStartIncluding": "6.1.0"}, {"cpe23Uri": "cpe:2.3:a:ibm:sterling_connect_direct_web_services:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "6.2.0.27", "versionStartIncluding": "6.2.0"}, {"cpe23Uri": "cpe:2.3:a:ibm:sterling_connect_direct_web_services:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "6.3.0.13", "versionStartIncluding": "6.3.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-07-18T13:44Z"}