CVE-2024-22348 IBM UrbanCode Velocity cross-origin resource sharing

Medium 5.3 Published 20 Jan 2025 Updated 21 Jan 2025

Attackers can bypass CORS restrictions to perform privileged actions and retrieve sensitive information from IBM DevOps Velocity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-22348?

CVE-2024-22348 is a medium-severity vulnerability in IBM DevOps Velocity, published on 20 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.

Weakness: CWE-942

Which versions are affected by CVE-2024-22348?

It affects 2 products.

Products include Hcltech Devops Velocity, Ibm Urbancode Velocity.

How do I fix CVE-2024-22348?

No fix has been published for CVE-2024-22348 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-22348 being exploited?

There is no known exploitation of CVE-2024-22348 in the wild and no public exploit code.

Sources

Also known as GHSA-j67f-pcrr-6x36.