CVE-2024-40683: falha de média gravidade em IBM Operations Analytics - Log Analysis
IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password change
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.3%
IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the system.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
IBM · Operations Analytics - Log AnalysisCVEs relacionadas — IBM Operations Analytics - Log Analysis
No mesmo produto, das mais perigosas para as menos.
CVE-2024-40684MEDIUMIBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout MechanismEPSS 0.4%CVE-2024-40685MEDIUMIBM Operations Analytics - Log Analysis is affected by CSRF Token Replay AttackEPSS 0.1%CVE-2026-7365HIGHIBM Operations Analytics - Log Analysis is affected by Information disclosure due to default passwords not being forced to be changed on post-installationEPSS 0.1%