« Volver al listado

CVE-2024-52891

Estado: AnalizadaMedia (5.4)—

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3

could allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Concert

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52891",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52891",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-07T14:47:31.775559Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:concert:1.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:concert:1.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:concert:1.0.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:concert:1.0.3:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Concert Software",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0, 1.0.1, 1.0.2, 1.0.2.1, 1.0.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-01-07T12:15:25.010",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7180303",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-117"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 \n\ncould allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization."
    },
    {
      "lang": "es",
      "value": "IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1 y 1.0.3 podría permitir que un usuario autenticado inyecte información maliciosa u obtenga información de archivos de registro debido a una neutralización incorrecta de los registros."
    }
  ],
  "lastModified": "2026-06-17T08:07:49.033",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "557B94A2-6EC2-4F29-95AE-306B55C7C11D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:concert:1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB02F586-96A0-4FAC-91CD-2B48EF222945"
            },
            {
              "criteria": "cpe:2.3:a:ibm:concert:1.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35C3FEC7-5494-4120-B80F-87E19F9874F4"
            },
            {
              "criteria": "cpe:2.3:a:ibm:concert:1.0.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BFF310F-2638-44A4-927B-9E799D9AC172"
            },
            {
              "criteria": "cpe:2.3:a:ibm:concert:1.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41C89595-90AB-41CD-AA0A-895E264CD474"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}