CVE-2024-41765 IBM Engineering Lifecycle Optimization - Publishing directory traversal

Medium 6.5 Published 4 Jan 2025 Updated 6 Jan 2025

Remote attackers can traverse directories via crafted URLs to view arbitrary files on IBM Engineering Lifecycle Optimization Publishing systems.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-41765?

CVE-2024-41765 is a medium-severity path traversal vulnerability in IBM Engineering Lifecycle Optimization Publishing, published on 4 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Weakness: CWE-22

Which versions are affected by CVE-2024-41765?

It affects 1 product.

Products include Ibm Engineering Lifecycle Optimization Publishing.

How do I fix CVE-2024-41765?

No fix has been published for CVE-2024-41765 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-41765 being exploited?

There is no known exploitation of CVE-2024-41765 in the wild and no public exploit code.

Sources

Also known as GHSA-87r4-wg36-7x2v.