CVE-2024-22334 IBM UrbanCode Deploy improper privilege control

Medium 4.4 Published 12 Apr 2024 Updated 1 Aug 2024

Incomplete permission revocation when deleting custom security types allows attackers to retain unexpected privileges in IBM UrbanCode Deploy.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-22334?

CVE-2024-22334 is a medium-severity vulnerability in Ibm Urbancode Deploy, published on 12 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type. When deleting a custom security type, associated permissions of objects using that type may not be fully revoked. This could lead to incorrect reporting of permission configuration and unexpected privileges being retained. IBM X-Force ID: 279974.

Weakness: CWE-732

Which versions are affected by CVE-2024-22334?

It affects 2 products.

Products include Ibm Devops Deploy, Ibm Urbancode Deploy.

How do I fix CVE-2024-22334?

No fix has been published for CVE-2024-22334 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-22334 being exploited?

There is no known exploitation of CVE-2024-22334 in the wild and no public exploit code.

All Ibm Urbancode Deploy vulnerabilities

Sources

Also known as GHSA-qmmh-x7m4-pr56.