« Volver al listado

CVE-2024-39745

Estado: AnalizadaAlta (7.5)—

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Sterling Connect Direct WEB Services

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-39745",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-39745",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-22T13:12:59.462908Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:sterling_connect\\:direct:6.0.0.0:*:*:*:*:windows:*:*",
            "cpe:2.3:a:ibm:sterling_connect\\:direct:6.1.0.0:*:*:*:*:windows:*:*",
            "cpe:2.3:a:ibm:sterling_connect\\:direct:6.2.0.0:*:*:*:*:windows:*:*",
            "cpe:2.3:a:ibm:sterling_connect\\:direct:6.3.0.0:*:*:*:*:windows:*:*",
            "cpe:2.3:a:ibm:sterling_connect\\:direct:6.0.0.0:*:*:*:*:unix:*:*",
            "cpe:2.3:a:ibm:sterling_connect\\:direct:6.1.0.0:*:*:*:*:unix:*:*",
            "cpe:2.3:a:ibm:sterling_connect\\:direct:6.2.0.0:*:*:*:*:unix:*:*",
            "cpe:2.3:a:ibm:sterling_connect\\:direct:6.3.0.0:*:*:*:*:unix:*:*"
          ],
          "vendor": "IBM",
          "product": "Sterling Connect:Direct Web Services",
          "versions": [
            {
              "status": "affected",
              "version": "6.0, 6.1, 6.2, 6.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-08-22T11:15:13.710",
  "references": [
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/297312",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://www.ibm.com/support/pages/node/7166195",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information."
    },
    {
      "lang": "es",
      "value": "IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2 y 6.3 utiliza algoritmos criptográficos más débiles de lo esperado que podrían permitir a un atacante descifrar información altamente confidencial."
    }
  ],
  "lastModified": "2026-06-17T07:42:35.207",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFF87194-EA30-4358-B6A4-45274815F742"
            },
            {
              "criteria": "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB84B3B4-6E20-4310-9BF9-DA8D3ED44E1A"
            },
            {
              "criteria": "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11E72803-A97E-45DE-AC70-EFF2BADCB7AF"
            },
            {
              "criteria": "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "914935D0-4F22-4653-8FCA-208AD42EFC94"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E492C463-D76E-49B7-A4D4-3B499E422D89"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}