CVE-2024-39725 IBM Engineering Lifecycle Optimization - Engineering Insights information disclosure
Remote attackers can obtain sensitive system information via detailed error messages, aiding further attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-39725?
CVE-2024-39725 is a medium-severity vulnerability in IBM Engineering Insights, published on 25 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
Weakness: CWE-209
Which versions are affected by CVE-2024-39725?
It affects 1 product.
Products include Ibm Engineering Lifecycle Optimization - Engineering Insights.
How do I fix CVE-2024-39725?
No fix has been published for CVE-2024-39725 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-39725 being exploited?
There is no known exploitation of CVE-2024-39725 in the wild and no public exploit code.
Other vulnerabilities in IBM Engineering Insights
- CVE-2024-39726 IBM Engineering Insights XML external entity injection
- CVE-2020-4974 Server-side request forgery in Engineering Lifecycle Optimization
- CVE-2024-39727 IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbing
- CVE-2020-5004 Cross-site scripting in Engineering Lifecycle Optimization
Sources
Also known as GHSA-3835-4hmw-pgj9.