CVE-2024-49782

March 11, 2025, 2:19 p.m.

6.8
Medium

Description

IBM OpenPages with Watson 8.3 and 9.0  could allow a remote attacker to spoof mail server identity when using SSL/TLS security. An attacker could exploit this vulnerability to gain access to sensitive information disclosed through email notifications generated by OpenPages or disrupt notification delivery.

Product(s) Impacted

Vendor Product Versions
Ibm
  • Openpages With Watson
  • *
Linux
  • Linux Kernel
  • -
Microsoft
  • Windows
  • -

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
CWE-297
Improper Validation of Certificate with Host Mismatch
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a ibm openpages_with_watson / / / / / / / /
a ibm openpages_with_watson / / / / / / / /
o linux linux_kernel - / / / / / / /
o microsoft windows - / / / / / / /

CVSS Score

6.8 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: HIGH
  • CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

    View Vector String

Timeline

Published: Feb. 20, 2025, 4:15 a.m.
Last Modified: March 11, 2025, 2:19 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

psirt@us.ibm.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.