CVE-2024-39747: high-severity vulnerability in IBM Sterling Connect:Direct Web Services
IBM Sterling Connect:Direct Web Services information disclosure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
IBM Sterling Connect:Direct Web Services comes with default login credentials that attackers can use to access critical functions without authorization. This allows unauthorized access to potentially sensitive operations and data.
The vulnerability stems from hardcoded default credentials in IBM Sterling Connect:Direct Web Services versions 6.0-6.3, enabling unauthenticated or default-authenticated access to critical web service functions. An attacker can exploit this with minimal preconditions (network access to the web service) to gain unauthorized access to sensitive operations and information disclosure.
In the same product, most dangerous first.