CVE-2024-22348mediumCWE-942

CVE-2024-22348: medium-severity vulnerability in IBM UrbanCode Velocity

IBM UrbanCode Velocity cross-origin resource sharing

Published · Updated

Follow this CVE+ Monitor DevOps Velocity+ Monitor UrbanCode Velocity

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
IBM · DevOps VelocityIBM · UrbanCode Velocity
Related CVEs — IBM UrbanCode Velocity

In the same product, most dangerous first.

CVE-2024-22347MEDIUMIBM UrbanCode Velocity information disclosureEPSS 0.3%CVE-2024-22349MEDIUMIBM UrbanCode Velocity information disclosureEPSS 0.2%