Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2024-37532
CVE-2024-37532:
IBM WebSphere Application Server vulnerability analysis and mitigation
Overview
IBM WebSphere Application Server versions 8.5 and 9.0 were identified with a vulnerability (CVE-2024-37532) that was disclosed on June 20, 2024. The vulnerability allows identity spoofing by an authenticated user due to improper signature validation (IBM Advisory, NVD).
Technical details
The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is categorized as CWE-347 (Improper Verification of Cryptographic Signature) (NVD).
Impact
If exploited, this vulnerability could allow an authenticated user to perform identity spoofing attacks, potentially compromising the confidentiality, integrity, and availability of the affected systems (IBM Advisory).
Mitigation and workarounds
IBM recommends addressing the vulnerability by applying interim fix PH61504 or upgrading to Fix Pack 9.0.5.21 or later for version 9.0, and Fix Pack 8.5.5.26 or later for version 8.5. Both fix packs are targeted for availability in 3Q2024. No workarounds are available (IBM Advisory).
Additional resources
Source: This report was generated using AI
Related IBM WebSphere Application Server vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management