April 30, 2024
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Cybercriminals Exploit Fortinet Vulnerability to Deploy ScreenConnect and Metasploit – Active IOCs
April 18, 2024Multiple WordPress Plugins Vulnerabilities
April 18, 2024Cybercriminals Exploit Fortinet Vulnerability to Deploy ScreenConnect and Metasploit – Active IOCs
April 18, 2024Multiple WordPress Plugins Vulnerabilities
April 18, 2024
Severity
Medium
Analysis Summary
CVE-2024-22329 CVSS:4.3
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker could exploit this vulnerability to conduct the SSRF attack.
CVE-2024-22354 CVSS:7
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, or to conduct a server-side request forgery attack.
Impact
- Gain Access
Indicators of Compromise
CVE
- CVE-2024-22329
- CVE-2024-22354
Affected Vendors
IBM
Affected Products
- IBM WebSphere Application Server 8.5
- IBM WebSphere Application Server 9.0
- IBM WebSphere Application Server Liberty 17.0.0.3
- IBM WebSphere Application Server Liberty 24.0.0.3
Remediation
Refer to IBM Security Advisory for patch, upgrade or suggested workaround information.